Dropbox: The Inside Story Of Tech's Hottest Startup | Hacker News Reader

Dropbox: The Inside Story Of Tech's Hottest Startup

forbes.com

384 pointsblurpin103 comments

Jobs tried to buy Dropbox, from Forbes profile of Dropbox and cofounder Drew Houston

Drew's case shows how hard it is to generalize. We're generally reluctant to fund single founders. And yet the most successful startup we've funded had a single founder at the time he applied:

http://dl.dropbox.com/u/27532820/app.html

We strongly encouraged Drew to get a cofounder, and he found Arash before the summer 2007 cycle began. Arash turned out to be the perfect cofounder. So Dropbox is pretty much the best case scenario for a single founder applying to YC. And the variation in startup outcomes is so great that even though we have such a large data set, the best single founder outcome is so far better than any of the multiple founder outcomes.

This is why one of our rules is that we'll break any of our rules.

That application is a joy to read.

One answer stands out for me, it probably was instrumental in the eventual success for dropbox:

  # Do any founders have other commitments between June and August 2007 inclusive?  
  > No; I've given notice at Bit9 to work on this full time regardless of YC funding.

That's really great. Drew had already decided to push ahead, with or without YC, he basically positioned himself to negotiate from strength, in turn increasing his chances of getting funded by YC.

That's showing a lot of business savvy there. Instead of coming 'cap in hand' he's telling YC: "If you want on board you may, but the train will run regardless."

That does count for a lot with us. It's surprising how many of the groups who apply have a cofounder who's not willing to quit his or her job. It's a worrying sign when someone who knows the company a lot better than we do isn't willing to bet on it. But again, there are always exceptions.

That's just common sense. I am not encouraging dishonesty, but I think you would be a fool to expect funding and not answer that question in this way. I actually assumed that question is in there just to weed out applicants.

Edit: More specifically, the "If we don't fund you, will you do it anyway" question.

> This is why one of our rules is that we'll break any of our rules.

which is also how DNA and gene machinery work. for good (beneficial mutations) and bad (cancer)

Jobs never changed his interpretation of things. He did in fact feel cloud storage was a feature and not a product, and that's exactly what iCloud is. For Apple it's a feature that will hopefully tie people in to their iOS devices. And with the likelihood that over time they will offer greater amounts of storage for free or a minimum payment, that's not good for Dropbox. I like Dropbox, I use it almost daily. But so far I've never actually paid for it. Same, so far, with iCloud. To Apple, this would be largely irrelevant, but for Dropbox, that's not so great.

What is the difference between you not paying apple or you not paying dropbox?

The upside for dropbox is you commenting here that you are using them and that their free tier is usable, so you are effectively a part of their marketing arm.

If you really get utility out of dropbox then it is in your best interest that they continue to exist. Sooner or later that might translate into you pulling your wallet.

Freemium offerings are predicated on statistics and dropbox seems to be doing just fine in spite of the freeloading nature of some of their customers.

There is no difference to me, there isn't much difference to Apple but there is to dropbox - their business is dependent on users paying for cloud storage. The problem with that, as I see it, is that in the longer run cloud storage becomes a commodity. Hence Jobs' description of it as a feature, instead of a product.

Access is also a commodity. That doesn't stop ISPs the world over from making a killing on it.

Yes, it is a feature if you've already got an OS and a bunch of devices out there.

But it is a product if you can do this seamlessly across all os's, and all devices.

Both perspectives are equally valid in this case. In the end to the DropBox guys their product vision was worth more to them than Jobs' feature vision allowed him to pay for it.

Time will tell if that was the right decision, for either party.

> What is the difference between you not paying apple or you not paying dropbox?

Dropbox gets money from you paying for dropbox (it's a service), Apple gets money from you buying Apple hardware, iCloud is just there to give you reason to get Apple devices and keep buying Apple devices.

> Freemium offerings are predicated on statistics and dropbox seems to be doing just fine in spite of the freeloading nature of some of their customers.

Absolutely, but Dropbox's goal will still be to push you on the "premium" side of "freemium".

I think you underestimate the value of marketing.

As fun as consumer services are most people aren't going to pay for them (or will pay very little). The real value in these types of services are Power Users and Business.

As someone who considers himself a power user and who runs IT for a business I can tell you Dropbox has been very effective in its marketing. We use Box.net and my users are constantly pushing for Dropbox because they use it at home and find it preferable. If Dropbox had the features we probably would have switched by now.

Same with Power Users in that word of mouth is likely to influence these people (though again I'd argue features in that the streaming ability of SugarSync is a real advantage for those users).

So as crazy as it seems Dropbox is essentially using you for marketing. Think about it, companies pay millions for a couple minutes of Superbowl time. With that money Dropbox gives millions of users a free service and uses word of mouth to carry it along.

I love dropbox - and I just recently switched to a paid account.

I have gotten my whole team on it - we have a virtual team of 10 consultants all working from our homes. Dropbox is key to keeping everything between us shared.

We haven't yet gone for the Team account - but we will be doing so shortly. It is expensive - but the simplicity and value it offers it (so far) unmatched.

Have they improved on their lack of security yet? I'd recommend using wuala for work documents as they offer client side encryption, if you don't mind having java around.

This actually scares me a lot about dropbox. I've had clients share very sensitive documents and code via an emailed dropbox link. If you are in charge of security, dropbox is a data-loss prevention nightmare. It's too easy to share things. I can only imagine what kind of IP dropbox has access to.

The value for me far outweighs the current security worry.

None of my data is life and death critical - so I dont fret too much about security.

I expect that Dropbox will get better, and the service is just invaluable to how we work.

Wouldn't a Version Control system (think Github) serve you better?

You have files on the cloud and get version control for free.

Unless of course all your stuff is huge binaries and you don't care about versioning.

iCloud is not cross platform. Dropbox has its place for this feature alone. In fact I use Dropbox mainly for syncing dotfiles between my various Mac OS/Linux/Windows machines iCloud just can't do that. The corporate world also lives on Windows and is a huge market.

"Jobs had been tracking a young software developer named Drew Houston, who blasted his way onto Apple’s radar screen when he reverse-engineered Apple’s file system so that his startup’s logo, an unfolding box, appeared elegantly tucked inside. Not even an Apple SWAT team had been able to do that."

Can anyone throw more context around this hack. Technical challenges to accomplish this will be bonus.

I'd be interested to know the meaning of the sentence.

How do you hack a file system to display a logo?

I'm assuming they're talking about the Dropbox logo that is displayed on the Dropbox folder and/or the sync icons displayed on the files and folders inside the Dropbox folder, functions which are likely reserved to the default System folders.

http://forums.dropbox.com/topic.php?id=12498

"more pertinent is the fact that none of the integrations we do with the Finder are actually supported by Apple. this means that it takes significant reverse engineering of the Finder to make icon overlays/contextual menu items to work. Apple completely removed support for contextual menu items in SL (it's possible to have right click options, but it's not possible to have a submenu, or a submenu with options that change dynamically based on context).

in order to make these integrations work we have to inject code into the finder to make in memory replacements of finder code with our own (many complexities/details of hackery omitted). if it were easy, you'd see more products than just Dropbox able to do it ;-)"

also: http://forums.dropbox.com/topic.php?id=938

I had no idea installing Dropbox meant they were modifying the Finder. Why isn't there an option to disable this?

Note that they are injecting code into the running Finder process, which is very different from patching the Finder binary. That would be very bad.

This would also break the code signing for Finder, I believe. (also bad)

They are injecting code into running Finder process? Hmmm, so they figured one of the jump instructions target address in Finder process ( for a function invocation, most likely the code to show the pop-up), and changed that location to jump to a different address where they injected their code? Don't you need root privileges to muck with Finder's process space? I see dropbox process running with non-privileged uid. Wonder, how they managed to change the VMM space of Finder process to inject code. Any thoughts? Please correct me, if I am totally off the mark here.

I think there are some hooks in OSX/Cocoa for doing this, although I don't claim to actually understand it.

There is the SIMBL system which people used to write native plugins for Safari, I guess that's probably stopped since it has an actual extension framework now.

http://www.culater.net/software/SIMBL/SIMBL.php

Then there's TotalFinder, which uses in-memory patching to add tabs and all sorts of other leet stuff into Finder. I highly recommend it. In their docs they say it works similarly to SIMBL.

http://totalfinder.binaryage.com/

So, hijacking shared libraries. I doubt they're actually changing the Finder process in memory. I bet their changes are localized to the library they hijack.

Thanks for the info. On further digging, I found this useful link - http://www.culater.net/wiki/moin.cgi/CocoaReverseEngineering

which provides some insights into accomplishing what Dropbox did.

A process can't change the address space of another process, period. Even if one is a root process. Separation of address spaces is a basic security service provided by the operating system. So I'm also puzzled how they are able to modify memory in Finder's address space.

The closest thing I can think of is that Finder executes arbitrary processes on behalf of the user. That is, when I double click on something, Finder has to do the fork-exec dance to launch that application. A process fork, however, creates an entirely separate address space for the new process. I would be shocked if Finder did not do that. So, yes, I'm also wondering what it is they do.

Thanks for the clarification. I was thinking may be they were mucking with shared libraries. I found this useful link on digging further. Doesn't seem like too much of black art. http://www.culater.net/wiki/moin.cgi/CocoaReverseEngineering

Not true, at least on OS X:

http://www.slideshare.net/rentzsch/dynamic-overriding

https://github.com/rentzsch/mach_star

I don't know if this is how Dropbox works, but it seems likely.

The first chunk of those slides talk about library hijacking. Say, you define your own version of malloc, make sure the application links to your version of malloc, and play your tricks from there. Process isolation has not been violated.

The last five slides seem to be doing this: http://www.blackhat.com/presentations/bh-usa-09/DAIZOVI/BHUS...

Slide 4 is the difference: OSX is BSD running on top of Mach. So these techniques use the Mach layer to get around basic process protection. This is terribly insecure.

Yeah, the injection stuff was what I was referring to.

Apple apparently changed OS X in 10.4.4 to only allow root or procmod group to do this http://guiheneuf.org/mach%20inject%20for%20intel.html

Dropbox does in fact use mach_star.

A process can't change the address space of another process, period.

Don't forget ptrace.

I had, but that's not the situation I had in mind. You can only use ptrace on a child process. You can't use ptrace to attach to, say, another user's process.

See PT_ATTACH, and wouldn't both Finder and Dropbox be running as the user?

You can attach to any of your processes, that's how debuggers work! Ever used gdb to attach to a running process and debug it on the fly? This is done with ptrace() with the PT_ATTACH flag.

Now ptrace is known to be severly limited on Mac OS X, but there are ways around it: http://uninformed.org/index.cgi?v=4&a=3&p=14

> A process can't change the address space of another process, period. Even if one is a root process. Separation of address spaces is a basic security service provided by the operating system.

That is not even close to true, on any operating system.

> A process can't change the address space of another process, period. Even if one is a root process. Separation of address spaces is a basic security service provided by the operating system. So I'm also puzzled how they are able to modify memory in Finder's address space.

Sure you can. Every major PC OS (Windows, Mac, Linux) has a debugging API that, in fact, does allow you to read and write the memory of other processes. Windows even has a convenient function to allocate blocks of memory in other processes' address space, and another function to spawn a thread in another process with an arbitrary entry point - which makes this sort of thing relatively easy to do.

Mind you, the primitives provided can be a bit difficult to work with, but it's far from impossible.

I'm not convinced that patching code into a running process [1] is any better than patching the binary on disk. That's the sort of thing that a fully secured system would not allow.

[1] Of course excluding programs that have an actual plugin interface, and the "patching" just constitutes using that interface.

This is the most interesting comment for me personally. Thanks.

Also, what the devil is "an Apple SWAT team"? I know this is an article in Forbes, but does it even sort of exist?

There's some information on them here: http://articles.latimes.com/2010/may/05/business/la-fi-silic...

"Ferdowsi from the start insisted Dropbox’s home page be a simple stick-figure video showing what the product does. No table of features and pricing; instead, a story about a guy who loses stuff and goes on a trip to Africa."

This made me realise I'd never been to the Dropbox homepage. I heard about the company here on HN (Drew's YC Application form is a great read), and I didn't have a need at that time - about 6 months later I took on a global project and one of the first emails I got from the client was asking me to sign up for Dropbox so we could collaborate.

As the article notes, that word of mouth (I've passed it on numerous times since) has driven growth, perhaps more than the homepage. After all - it just works.

I found this part of the article a little strange. I've heard Drew present alongside Adam Smith and recall him talking about how the design of the home page started off way more complex and that it was through A/B testing they ended up with the video.

Journalistic license maybe?

Then come Chris, Jason and Joe (who has a Dropbox tattoo on his arm because he feels “Drew is changing the world”), more MIT brothers aiming to live a California dream they all imagined back in Cambridge as “billionaires, bottles and babes.”

Eww, that's offputting.

> "billionaires, bottles and babes.”

When the reporter in the video interview brought that up he seemed pretty embarrassed.

Sounds like something university students might say.

If they made that statement as adults I think it would be more off-putting.

It was almost certainly a joke. Avoid sarcasm when talking to journalists; some quotes, out of context, are too good to pass up.

wildly out of context (comically so if you know me IRL) -- oh well :)

Yeah I cringed when I read that part. I guess not every press piece will be perfect, and hey, they have to sell magazines ;)

Sounds like a genuine sausagefest.

I don't find it offputting; I think it's expected:

http://en.wikipedia.org/wiki/Maslow%27s_hierarchy_of_needs

Might as well say vast swaths of all young men are off-putting. These are pretty standard motivations (though usually not stated so bluntly + publicly).

Agreed, vast swaths of young men are indeed off-putting.

While I love Dropbox and have it installed, I think they are right to fear ICloud. After getting a 4s and being able to simply type my AppleID, I instantly had all my contacts, videos, photos, music, settings, and bookmarks instantly and seamlessly synced. Best part of it all was that I didn't even know I was using ICloud. I didn't have to setup or download anything. It was so simple. Since I'm a mac user, I really don't have much use for Dropbox anymore.

How many people would sit in front of Steve Jobs, refuse to a hundreds of millions acquisition offer, just before Apple enters their market. You got to admire Houston. He might reach the moon.

The dividing line between stupid and brilliant is usually determined retrospectively.

Exactly look at the Groupon/Google situation

(which is still to be determined in my opinion)

Also reminds me of Yahoo refusing to buy Google. I am sure they had good reasons for that decision then.

Note: 9-digit is less than one billion. Nothing to sneeze at, though. ;-)

Correct. Fixed that. A Billion here, a billion there, and pretty soon you’re talking real money.

My biggest issue with Dropbox, and I am probably not alone in this, is still security. After the lapses earlier in the year, I still store most files in a TrueCrypt share in my DropBox folders. Since I can't access the TrueCrypt volume from my phone or other mobile devices, it limits the portability of the data.

We've been told they do encrypt files internally. I don't think there is any usable way to have users manage their keys by themselves. Who wants to input large encryption keys to their mobile phone every time they want to use Dropbox? And if the phone remembers the key, then it's not too far from the current situation.

"My phone stores my private key" is very, very far from "Dropbox's servers can see all my data".

Certainly, but the practical privacy implications are probably similar. In case of a stolen phone, the thief has access to all the files in both of these cases. Sure it would be cool if Dropbox wouldn't have any access to our files, but I don't see how it would happen without eroding the usability. It could be an opt-in feature of course.

Dropbox can be subpoena'd.

2 gig free, next step up is 50Gb. Anyone else find the big jump means they use the dropbox just for day to day projects? A 10 or 20 Gig price point at $5 a month would be something I could rationally use.

Agreed. I always wished Dropbox had a lower, entry-level tier for around $5/month. I don't need 50gb. I just need 5-10gb.

There's no need to even have tiers - it would be great if they would just charge you $X/GB/month over the free amount.

I'd think it's a deliberate design choice having it this way. If you think about it, paying only for actually used space would mean a lot smaller income for the company.

Maybe it would also erode the magic in it - people would start thinking if they should have this and that files on Dropbox or not. Or accidentally piling up huge bills doing some mistake managing their files...

I don't know about that. Sure, there are some people using 5-10GB of a 50GB account, but I'm sure there are lots of people that are sticking with the free account when they'd gladly pay a little bit $1-$2 for slightly more storage, and people at the other end that are either frustrated by the 100GB limit or haven't even bothered using the service because they know they need to store more than 100GB.

I trust Dropbox has done extensive market research and concluded that having two price tiers, plus the other benefits that come with such simplified pricing, outweigh the flexibility of usage-based pricing.

Actually, you can reach that capacity through referrals. I have 8 GB for free, for example.

This is totally self serving (http://news.ycombinator.com/item?id=3126173). If you're on the free plan, you should be able to max out your referrals at somewhere between 8-10GB of free space for you (they may have lowered it). I got 30 referrals for less than $10....give it a shot, I've had friends try this recently and they didn't end up spending more than $15.

I pay $49/year for 10GB. Dropbox doesn't advertise but if you request it they'll quote you for other storage amounts and let you sign up.

20GB for $49/year is what I really want. Hopefully they'll do that soon.

Here is what they told in late 2009 - don't know if these links still work:

Thanks for writing to Dropbox. We recently ran a market test for intermediate plans that has ended, but I can still offer you the plans:

- 10GB $4.99/month or $49/year - 20GB $6.99/month or $69/year - 25GB $7.99/month or $79/year

You can use the following links to sign up for one of these plans. You need to be logged into the Dropbox website for them to work:

* 10 GB: https://www.dropbox.com/upgrade?plan=10&v=11396bf * 20 GB: https://www.dropbox.com/upgrade?plan=20&v=e6ad6ff * 25 GB: https://www.dropbox.com/upgrade?plan=25&v=9fb5a23

> Here is what they told in late 2009 - don't know if these links still work:

They don't.

Well, perhaps I should drop the British reserve and send them an e-mail. I could have all my teaching materials in the cloud then. Everything that I've used in 10 years available anywhere...

It is a big jump. And that first 2GB seems (or seemed at the time) very generous for free.

I wonder how many of DropBox's users are 2GB-only? I remember feeling very willing to try it, because it was free, and a lot of space for free. It worked so well for me (I'm still only 58% full) I have no need to upgrade. It's quite a loss-leader for DropBox, but presumably an acceptable one.

But looking at my stuff on disk, I've got:

- text and documents - projects - source files

which fit easily within 2GB, and

- a vast photo library - an enormous music library - a titanic video library

which don't fit easily within anything.

So for me a sensible jump would be from 2GB to, ooh, 2TB... :)

I really like Dropbox. I wish they were actually encrypting users' data in a manner like they originally advertised they were. This is my only concern with using their service.

I understand that they wish to save space with deduplication and that this requires them to look at your files a fair bit prior to encryption. I just prefer they let users opt into using their own private keys.

Been amazing watching the entire process, from YC hopeful to Forbes cover. Way to go Drew.

$240M Revenue? Holy CRAP!

As I predicted some time ago - http://marcgayle.com/how-dropbox-is-printing-money - I am pretty sure that once Dropbox reveals their profit margins, the world will be stunned.

Mark. My. Words.

Does Forbes.com have a print URL? I couldn't find one (did find a print.css which does almost nothing to optimize for printing), and I'd rather not encourage their splitting the article onto 4 separate pages by clicking through.

Unfortunately I don't think we do

In this case, however, it's a cover story -- the best print format we can offer

I'm very surprised they split it into 4 pages (it didn't feel like much content on each page).

(I understand why web publishers split pages, but you can take it too far.)

Single-page view: http://viewtext.org/article?url=http%3A%2F%2Fwww.forbes.com%...

I believe they would rather you go buy the magazine, rather than print it out.

Works find in readability. This link might work for you:

http://www.readability.com/articles/giut9xtb

I think context is important here. I don't think I am wrong in saying that most YC startups consist of 20-somethings, perhaps even in their low 20's. At this age few are truly prepared for the stress, conflict and issues that running a business could bring to the table. And, in this context, it is probably far better to have more founders rather than less.

I've been an entrepreneur ever since I can remember. And, retrospectively, I know that I did a lot of dumb things when I was younger. It takes a while to develop the business smarts, thick skin and, if you will, intestinal fortitude a business requires. I've experienced business issues as I got older that I know would have totally decimated me when I was younger. You are simply not prepared for that sort of thing. Particularly things like impending catastrophic failure, when you need to be mentally and emotionally in your strongest mode.

Barely-out-of-teenage-years entrepreneurs (not meant with disrespect at all, just chronological fact) need a support system in order to stay the course, learn and not derail. That's why I think that in these cases the multiple founder "rule" is probably a very good idea.

I would say that older solo founders with previous skin in the game are probably a good bet (all else being equal). One young founder thrown into the jungle that business can become is probably a formula for almost certain failure.

While, of course, there are always exceptions to every rule, I do think that what I am saying is a reasonable characterization of the problem.

I use dropbox everyday for work and my personal life. I have two problems with dropbox though. 1. There is no paid plan between the free 2 gb account and the $100 50 gb account. A nice 10 or 25 gb account would be great. It is hard for me to justify spending the 100 a year when I don't need all that space. 2. There has not been a huge change in dropbox since it's inception. I find myself using it less and less, since it is so easy to share documents with google docs.

Inspirational story, thanks for that Forbes. I wish I had started programming from an earlier age (I only started 4-5 years ago, I'm a junior at UT Austin) but Drew is still an idol for me for both his crazy development skills and entrepreneurial talent. I use Dropbox on a daily basis and definitely laude him for seeing the idea through and not selling it to a big fish.

This story sounds like the story of Audion, SoundJam, and iTunes nearly 10 years ago:

http://www.panic.com/extras/audionstory/

I think one lesson of the Dropbox story is that you can build a company around a feature of minimal product if you have a savvy team and crisp execution.

I don't closely follow the changes to Apple developer APIs, so this may be blindingly obvious to others but not to me. Does anyone know if Apple is providing iCloud APIs for iOS/OSX?

I suppose, something similar to the file/db libraries, only these would go let you persist files and settings to iCloud (similar to Valve's SteamCloud for games).

Never mind. I see it. http://developer.apple.com/icloud/index.php

Does DropBox have anything similar? This looks like something that will run over DropBox.

http://www.dropbox.com/developers_beta

So the fight is on two parts of the board: the part where consumer sees and the part where only developer sees.

The next question: think iCloud -- or DropBox even -- will provide Google Wave technology? I have no idea how useful that would be to all apps. But it would benefit an app such as Ulysses.

Ulysses markets itself as a writer's editor. (To my programmer's eyes, it looks more like an IDE). It distinguishes itself in the market with a very strong document management system. However, it does not have auto-save, and the backups are kept in some obscure location. That's ripe for iCloud or Dropbox integration. However, it can go farther -- some method to sync changes with editors and proofers without having to export to Word.

Dropbox is written is Python correct? Would it be faster/more efficient/smaller footprint if it was written in C++?

I just have this (likely) wrong perception about Python from the original BitTorrent vs uTorrent.

I think he means that all the server side stuff is Python? The native Windows application is probably written in C++ though. Or did I completely misunderstand your comment?

Just curious if Dropbox had a MVP? If so, what was it? Was it ready and launched by Demo Day? Was it a purely free model, or were they already going with the freemium model at launch?

See a need, fill a need. Love it!

Sorry, I don't read articles divided in pages. Fuck you Forbes.

Press release (and TC) says 45+ million users. Forbes says 50 million. I think 50mm is more like it.

Reply on news.ycombinator.com