Hacking the Dropbox Space Race | Hacker News Reader

Hacking the Dropbox Space Race

blog.burtonthird.com

54 pointsjosh_blum40 comments

I don't have serious problem with this... but ballot stuffing and fake account registration seems the domain of SEO/blackhats or Anon. This isn't a 'cute hack' worthy of praise -- it's just abuse of MIT and Dropbox systems for no great reason other than perhaps pride.

As noted below, MIT had a significantly higher target than any other school. The jump from 15 to 25 for MIT was ~50k points while NUS (26k students) got to 25 around 25k total points. Remember that by "not cheating" there are only ~10,000 MIT students (undergrad and grad), so the goal is impossible without cheating (there aren't that many faculty members and staff).

It wouldn't surprise me if they assumed it would be cheated, so this was an attempt to improve their fraud detection. After all, it's not like these extra 50,000 accounts actually cost much to Dropbox. They each will presumably have only the starting files in them which are all duped in every other account.

Do alumni count as legal in the race? I definitely used my old @mit address to get in on the winnings.

If so, that expands the pool significantly :)

They were at the beginning, but got shut out within a few hours. I made a few mailing lists for some friends who graduated and missed the window.

I think Drew, as an MIT alum, expected MIT to script the process anyway. In fact, I'll bet he's proud that his alma-mater by-passed dropbox's flagging filters. Also, now Dropbox can look to hire new potential MIT interns and employees.

I see no problem with that ^^

Apparently yes: http://news.ycombinator.com/item?id=4681215

> Dropbox’s founder and MIT Alum, Drew Houston, tried to lessen our emotional damage by creating a “United States Leaderboard” where we still held the #1 position

It's pretty funny how butthurt the MIT people are that the Singaporeans and Taiwanese managed to beat them. If you look at the leaderboard[0], Houston even put the "United States Leaderboard" above the "Global Leaderboard" so that people would think that MIT was in first place.

0: https://www.dropbox.com/spacerace

Its hard to compete with a school who has about the same number of undergrads as MIT does people (undergrads, grads, and faculty)

Enrollment statistics of National University of Singapore http://www.nus.edu.sg/registrar/statistics.html or of National University of Taiwan http://www.ntu.edu.tw/engv4/about/about.html

So? MIT itself is larger than many other universities. Those universities may think that MIT has an unfair advantage.

Luckily, they made the point target for MIT >> population, so it's irrelevant.

Actually, which leaderboard is shown on top depends on your (connection's) location.

I'm going to guess you are from the US.

For me in Israel, Israel's board was the top one.

Yep, definitely based on location. For me, it shows the India leaderboard first.

It's worth noting that MIT did get "punished" for cheating: the required number of points for the extra 25GB space was relatively much, much higher: http://i.imgur.com/QLJP5.jpg

It doesn't matter when you can create unlimited e-mail addresses, though.

The scaling for the number of points was set before the hack took place. Not sure why Dropbox made it so much harder for MIT vs CMU. Also, creating the mailing lists was actually one of the biggest bottlenecks and actually ended the progress, so its not exactly unlimited :)

I wouldn't say it's cheating per say. When you open this kind of event to the the world, you're definitely attracting going to attract alot of people who are good at tech stuff - and throw that in with human tendencies, creativity and competitiveness sets in.

Maybe it's because I play quite a bit of online games (so I don't find it too troubling. Since there's no real stakes in play in this DB Race) but most gamers are always looking to calculate (or exploit), pushing the boundaries and efficiency of their playing experience. The only difference is the various levels each party takes it to.

To me (as a outside audience), the boring way is to get real students to sign up. Creatives and non conformers (trying to win) will be the ones to watch for. Whether it's auto email generation and sign ups, poking at DB servers to do w/e, or even posing as another university and massively signing up and crashing the servers and getting them disqualified. Imagination and how far/risk you're willing to go is the limit.

(And this is even more common and evident in competitions, like cute Dog photos, where most likes/votes win something - and you get people generating fakes and voting. Kinda expected more 'action' with all these tech schools involved.)

And those crying foul at the US Leaderboard being at the top - I'm pretty sure it depends on your position/location cause I'm seeing Canada leaderboard. So let's all calm down :D

It seems like cheating/fraud to me. Dropbox provides a service that usually costs money. They're also offering to provide service for recruiting new users instead of charging money.

If you fake users, you're getting the service without fulfilling your side of the bargain (paying money or recruiting users). That seems like fraud to me.

That being said, I'm sure Dropbox expected some of this behavior and is still happy with the legitimate signups and overall press they're getting.

I would characterize this as cheating/fraud, not as hacking. The technical details are interesting nonetheless.

What if I told you... this could have been prevented by using captchas?

I imagine requiring your users to fake a MAC Address is a pretty effective captcha. For Dropbox, it's probably better to reduce the friction in the sign up flow than to prevent against these kinds of edge cases.

> I imagine requiring your users to fake a MAC Address is a pretty effective captcha.

I guess we disagree over the meaning of the term 'captcha' then. Besides that, it is also pretty trivial to spoof a MAC address.

> For Dropbox, it's probably better to reduce the friction in the sign up flow than to prevent against these kinds of edge cases.

Agreed. But there are smarter ways to do it. Take Gmail for example - it normally doesn't require you to pass a captcha. But if you fail a certain number of login attempts, it does. How hard can it be to start displaying a captcha after, say, 5 accounts get registered within 24 hours for the same IP address?

It would have been harder to do but not impossible.

5 seconds per captcha * 30000 accounts = ~42 hours That is if they use can't OCR.

Your eyes will bleed after 42 hours.

It can be distributed to 10 students which would make it 4.2 hours per person. That's more than doable.

would you do it? :)

I wouldn't. That doesn't mean someone else wouldn't.

Heck if you can get 1000 students to do it, then it's just 2.5 minutes. Now that's something that even I would do.

"MIT students aren’t ones to brag" pretty good one :)

It's interesting how the US Dropbox leaderboard (https://www.dropbox.com/spacerace) kind of reads like the US News engineering university rankings (http://grad-schools.usnews.rankingsandreviews.com/best-gradu...).

Although, I was really hoping Georgia Tech would beat MIT for once in something...

(I was tempted to write a script to do something similar to what those guys did, but I can't afford losing my campus internet access if caught.)

Where's the glory in winning if you cheat?

This is why we can't have nice things.

Edit!

It has less to do with winning than the fact that MIT students want the dropbox space.

It's worth noting that MIT is still at 15gb even while in first place.

Hacking Dropbox's SpaceRace to win is pretty glorious.

There's a certain mindset under which a) most contests are boring, b) there exists a metagame over all contests, and c) that metagame so fascinating that success in it is interesting irrespective of the details of the underlying contests.

I don't necessarily subscribe to that values system, but part of me understands the attraction.

Where's the glory in cheating if you don't win?

"It’s left one of us without access to MIT’s network." - I'd be interested to hear what happened.

Why MIT is at first place while they have 14,939 racers and Singaporeans have 17,497 racers?

Because they have more points - you get extra points for referrals and completing a set of 'Getting Started' activities.

Reply on news.ycombinator.com