How Dropbox Knows When You’re Sharing Copyrighted Stuff Without Actually Looking
techcrunch.com
techcrunch.com
EDIT: Sorry, the moral is probably avoid copyright violations. The advice above is more like the practical workaround. It's nonetheless useful as a way to avoid overreach from rights holders in cases of false positives or suppression of fair use.
echo a >> file.mp3
For now I'm going with Bittorrent sync [1], at least until an equivalent service with an open source comes along. (Would be nice if they open sourced theirs, though.)
Something like tarsnap is the only paranoid-proof choice. It's not even distributed as a binary file.
And they can be ordered to do so secretly with no notice, neither to company management nor to you nor to any judicial body that could review the decision.
That's the lesson of Lavabit.
Now, I don't believe that they'd do this maliciously (rogue employees aside), but there's always the possibility that a government agency could secretly require them to actively try to capture a particular user's password the next time they sign in.
https://github.com/calmh/syncthing
git-annex with the assistant was supposed to be a dropbox replacement too but I haven't had much luck with it.
The developer is awesome but he seems to be going at this from "how can I make git more userfriendly" instead of "how can I implement a dropbox that just happens to use git". clearskies/btsync/syncthing won't inherit all the great git stuff (great versioning mostly) but they seem to be more on track to give a good user experience.
I'll be limiting my use of it and hope that ClearSkies goes well.
They provide discovery, syncing & NAT traversal to a hard drive that you own.
Since you seem to be talking about having their systems touch any bytes of the file, I have a more important question: How would you expect to have a file synced with dropbox and shared via dropbox without dropbox touching the bytes? Magic?
* you know what I mean by analysis, think gmail
Dropbox has no idea what is on the volume.
(In an ideal world, you'd have a filesystem set up that was a separate encrypted file for each file in the virtual filesystem, with an additional encrypted file that contained the virtual directory info. But this is simpler.)
I know that, and you know that, but I showed this article to my wife (who is a casual computer user), and while she understood the difference when explained, she said that as a non-techie, she interpreted the title differently. If you hash my data, and take action based on that hash, then you have looked at the data, however cursory or algorithmic it may have been.
FWIW, I had this same discussion on reddit, where it devolved instantly into name-calling. HN is much more civil. Thanks for that.
It's the DMCA sharing check that avoids 'looking' even in the most pedantic sense, not the overall use of Dropbox.
I have no idea how much efficiency this buys them, but the same mechanism can be used against a blacklist of known copyright or illegal materials. In this case, having a hash that matches something in the copyrighted materials list AND sharing it triggers this action.
Just as easily, putting some child porn in your DB could also have them check against illegal material hashes and trigger an automated notice to some law enforcement agency or something similar.
This can even be used for National Security without violating the classified contents of the documents. Say another Snowden-type grabs a bunch of classified documents. The agency could give DB a list of hashes with instructions to "call us" if a user uploads a bunch of leaked documents to their DB. They could even do this blind, just send DB a hash of every classified document or piece of data they ever produce and catch leakers before anybody in the agency even knew something was leaked internally.
You end up over-blocking, unless you include some option to bypass the block, in which case why even bother? It's not like you could inform the copyright holder when someone shares the file without invading users' privacy and opening up the system to abuse against political speech.
The whole thing is a mess because the fundamental problem is that the cost of most infringement on the internet is less than the cost of evaluating whether that use is infringing, so you end up with a high error rate no matter what you do. It breaks the founding assumption that copyright is not in tension with the First Amendment and makes you choose which you want to sacrifice for the other.