Dropbox on Mac now updates itself with a process in background

> Which is good because we do nothing wrong. Apart from Youporn, where only one underage model that you didn't know about could lead you to jail. You know, accusations do wonders for your career.

> Apart from this catastrophic scenario, I don't either see what's wrong. How many people per year are accused of pedophilia, that could be due to conflicting work/nation interests?

Thank you. And to people who think this won't affect them, it doesn't even have to be cp charges. NSA has lost the fight to keep its uncensored dragnet data to itself. Today, it is FBI who has access to it. Tomorrow, it will be the IRS which is fine. However, the real kicker will come when state departments of revenue and city police get their hands on it.

Remember, we as a people, legitimately break the law millions of times every day. It doesn't have to be cooked up evidence. If someone wants to hang any of us "upstanding" citizens, they just have to look hard enough.

And to do that, there's no need to work with Dropbox. Eve could just work her way through your colleagues you are sharing files with to find the weakest link, plant the documents on his computer and wait for them to automatically sync to yours.

What's wrong is that the capability to safely serve and share files over the Internet to people you want to serve, safely and with some modicum of security, is perfectly within the reach of the vendors of Operating Systems.

However, these vendors have fallen asleep at the wheel and are allowing basic system services to be fractured at the base (i.e. in the base OS install), in order that third parties might fill the gap.

This is a heinous state of affairs for anyone thats been paying attention over the years, because there are no good reasons we can't just use our existing computers, and their operating systems, to provide the same kind of user experience as one might obtain with Dropbox, albeit without the creepy commercial-control/exploitation aspect.

I mean, honestly, if folks would just have a way to create their own VPN's out of the box, share the details, and set up a peer network as if it were .. y'know .. a function of the operating system instead of something you learn about from seeing it on a billboard or the back of a bus ..

Dropbox seems to be singled out for doing things like this, despite browsers, Win10, etc.

The updater changes nothing unless someone has done a full audit of the Dropbox binary.

Updater or not, Dropbox/$minitrue can read/write anything you store there. If you have any executables (incl. source code, word docs with macros enabled, git repos via hooks…) in Dropbox, you're pwned as well.

If you don't trust Dropbox, an updater is the least of your concerns.

They could also distribute Dropbox through the Mac App Store, then they wouldn't have to sneak in SUID binaries and run background processes with launchd. As an added bonus, Dropbox would be sandboxed.

Before someone says it can't be done: the OneDrive app is installed via the Mac App Store, is sandboxed and provides Finder integration. (Yes, the Office badge would probably be a problem, but that is a hack now anyway.)

Edit: that sounded too negative. I agree that this benefits a lot of users, I just wanted to point out that an App Store version would be even better.

I agree that auto update is a net positive and most people will be fine with the arrangement. But your line of argument is flawed . by this logic anyone who wants to enquire and wantto have an informed discussion on health he /she should go study medicine ? Right !

No, it won't.

It's an urban legend.

For every support request that cannot be answered from a stock pile of answers, the first reply is "update to the latest version and then come back." and not once did I see anyone ever complain about it (leave alone become angry) in my 20+ years in IT business. Never. Not a single complaint. Those who can upgrade will upgrade when asked.

Don't install their apps then. There are lots of alternatives out there.

It's open-source (Chromium project) - just compile it yourself?

Once you've run somebody else's binary, you're already conferring significant trust on them. And I might be biased, but the Chrome team has shown themselves to be very vigilant with security, and generally on-the-ball on all of these things. (Memory issues aside...although I'm not going to get into that...lol).

Many newer projects do this - e.g. Atom from Github auto-updates.

VS Code from Microsoft does this - I think it's awesome! =)

But unless you audited the chrome code (with a team of 1000 experts) you have already trusted them, both to write quality code and to prevent malicious code sneaking in. Why not trust them to patch your browser against malware?

Feel free to contribute to ungoogled chromium: https://github.com/Eloston/ungoogled-chromium

The Dropbox sync service, on the other hand, is literally just the client half of Dropbox's own proprietary backend. If Dropbox makes an ABI-incompatible change to their sync protocol on the server side, the non-updated client will just break until you update.

Wanting to disable updates to such a service, would be like wanting to load the old version of a webapp SPA whenever you visit the site. What's the point? It's not going to (have been designed to) work that way.

Though this is not a phone app and Dropbox does have a history of mistakes causing data loss.

I assume it's true because: "If you don’t want Dropbox Update to run on your computer, you can uninstall the Dropbox application. You can still access your files on dropbox.com and using the Dropbox mobile apps."

I know my phone is a security mess. But I want my desktop not to be.

I'm on the latest iOS (10.2.1), and it's optional - I have 23 apps ready for updates, but I can scan through the release notes before initiating the update.