Hacker News Reader

Comment by lacker | Hacker News Reader

They make their money from enterprise software, for which privacy and access controls are very important. The other tech leaders on the board are more consumer-focused businesses, and consumer-focused businesses generally don't care as much about privacy.

View on HN

You're 100% correct and the replies to your comment are missing the point. People can have whatever complaints they want about the equality of encryption etc (and maybe those are valid, I don't know), but your point still stands. People here seem to be missing that when you're dealing with enterprise customers, their primary concerns are security, compliance, etc. So yes, running a company that sells to enterprise gives you a very different perspective from what you'd have running a consumer media company. Whether that helps FB I have no idea, but that's a separate debate.

How it helps FB is that it is trying to expand its market into business software - aka using Facebook Groups and FB Messenger, on your own shard. It competes with Slack and other similar worksplace IM systems. Drew Houston's experience at Dropbox is greatly helpful as Facebook tries pushing harder into that market.

Great point, thanks for this

FB has a little something called Workplace - https://work.workplace.com/

Right! Totally forgot about this, thanks

>They make their money from enterprise software

AFAIK they don't, though. Dropbox is still primarily getting its revenue from consumers, not b2b. They have been attempting to pivot to serving more enterprise customers, but are struggling to get traction there.

Given that, combined with the second part of your comment, kinda makes the parent comment's point.

1) Files are not encrypted on Dropbox servers. 2) The Dropbox client scans files on your machine that are outside the Dropbox folder. 3) collaboration with others via 3rd party app requires you to grant the app access to your entire Dropbox directory.

Not only is privacy not a focus at Dropbox. It isn't even a consideration.

Do you have a source for claim #2? Please share

https://www.dropboxforum.com/t5/Installs-integrations/Too-hi...

Most people in that thread are just complaining of high disk usage without specifying where access occurs.

Then page 3 has the following user report:

> I'm running Windows 10 and my Dropbox is located on my E drive (E:\Dropbox). I also notice high disk activity. However when I look in Resource Monitor I noticed that the high activity generated by Dropbox.exe is on the C drive (not E).

To which an employee says the reason is that dropbox is installed on C:.

> Although you have your Dropbox folder on your E: drive, the application is still installed on your C: drive, so that’s why you’re seeing the activity there.

Sorry, I did a poor job explaining. The smoking gun is CPU usage not file system activity. Perhaps you know more about this and can explain it to me. If I copy files from one place on my system that is outside of my Dropbox folder to any other location that is also outside of my Dropbox folder, how is it even possible for the Dropbox client to consume CPU resources if it isn't monitoring files outside of the Dropbox folder?

Here is link showing more people reporting the same problem. Files being copied from one part of the file system to another and the Dropbox client consumes 60%-100% CPU. I cant even comprehend how that is possible.

https://news.ycombinator.com/item?id=12464901

> how is it even possible for the Dropbox client to consume CPU resources if it isn't monitoring files outside of the Dropbox folder?

I did not debug this or look at anything, so I can't tell you.

One plausible explanation is they are effectively polling Dropbox folder instead of blocking until actual changes occurr. So maybe that hogs CPU scanning the Dropbox folder at inappropriate times, meaning that other activity on the machine has to compete for CPU time and lock acquisitions with unrelated but very noisy requests from the Dropbox client.

The fact that some users say that adjusting ACLs might get their client "unstuck" would fit this theory. Maybe they had a bug that generates noisy scans on the disk when they get "access denied" in an unexpected place.

But really I have no idea.

You seem to be living in some imaginary world in which Dropbox is able to sell to enterprise companies of all sizes and yet privacy is not even a consideration. A little weird how most companies are extremely hesitant due to concerns about compliance, regulatory and privacy issues and yet unbeknownst to them (but known to you apparently), privacy isn't even a consideration at DB! You might have legitimate complaints about the level of security DB offers, but to claim privacy isn't even a consideration is just stretching it to absurdity because DB would have ZERO chance or selling to a large portion of its highest paying customers if privacy and security weren't considerations at all.

Little weird they have a 45 page whitepaper on security even though it isn't a consideration at all! https://aem.dropbox.com/cms/content/dam/dropbox/www/en-us/bu...

Security and privacy are not the same thing.

Excuse me for saying I think there is a lot of unnecessary rage-caps and hostile sarcasm in this reply. Gp is not personally attacking you, but it reads like you take threats to Dropbox's honor pretty personally.

I do not think gp is living in imaginary worlds for example.

I haven't made any complaints about Dropbox's security. I made complaints about their privacy - which you are incredibly naive about.

Have you ever built a business on the dropbox API? Have you ever had to store and manage thousands of "full access" tokens of other users? Are you aware that every 3rd party that has a "full access" token has unbound access to read any of the files since the files are unencrypted?

The following url tells you how many 3rd parties have "full access" to your dropbox files. Take a moment to appreciate your privacy is dependant on the security and discretion of each and every one of those 3rd parties.

https://www.dropbox.com/account/connected_apps

Claim 3 is false. You can jail them to specific directories.

Dropbox supports two types of 3rd party apps each with different file permissions. 1) Sandbox, and 2) Full Access. If you jail by registering a "Sandbox App", you give up the ability to share/collaborate in a directory with other Dropbox users. To have a third party project that provides sharing you must abandon the "Sandbox" permissions and instead request "Full Access" - which means you get a token that give you access to the users entire dropbox directory. I have several email threads with the Dropbox team discussion this issue at length. Perhaps this has changed since I was neck deep in this issue but I don't see anything in their changelog to suggest that.

Ah, wasn't aware of that.

Claim 1 is 100% false also (ex Dropboxer here), they encrypt files at rest in 4MB chunks for all versions of the product (from free, pro, plus, business and enterprise). It’s in their security white paper too: https://www.dropbox.com/static/business/resources/Security_W...

Claim 1 is 100% true if we're talking about end-to-end encryption where Dropbox doesn't have the key. That is more likely what the parent meant.

Security and privacy are not the same thing - and how the files are stored on disk is irrelevant. Obviously the files are also encrypted in transit as well. The bottom line is Dropbox holds the keys on their end and has unencrypted access to the files on while on their servers. They can read the files at will. That is not an architecture that is focused on privacy - which is fine, but it shouldn't claim to be otherwise.

Reply on news.ycombinator.com