"User side encryption requires that there can be no website access, unless you do something easily as stupid, like Javascript or web plugin based encryption."Wait. What? I use a service for work here that does full client-side encryption and there's still web access. The entire decryption engine runs in javascript. The only thing I can't do is a server-side search based on file contents. Whee. It doesn't make the system 100% fool-proof, but it's much farther along the spectrum of security than DropBox.
So you're cool with running arbitrary code from a vendor to encrypt your content? I know you can read it. You did audit the code right? And run hashes on it to make sure they don't change to rot13 when you aren't looking? And there's no side channel uploading of the content unecrypted? Or the key?We audited the code because we wrote it. (And, yes, we actually have someone whose actually sane about security on staff.) The same rules, however, would apply to a third-party solution: Mozilla's signtool to bundle a signed jar which validates the signature of the JavaScript code that you're running. We're the ones doing the signing (and only our key is permanently approved for code exec on these machines) which, if this were a third-party service, we could still do on their JS. They'd likely charge us money for the annoyance of hosting one extra file for us, but its not like it would cost the server anything.
Well, I like Dropbox in large part because it works with Linux. But I've got to admit that Jobs is probably right, in the long run it's a feature not a product.The problem with calling it a "feature not a product" is that it's a feature of something and not anything else. I mean I'm guessing you can't use iCloud with Linux, can you?
I guess if you're investing in dropbox, you're assuming that at some point, amazon pulls the plug on you and suddenly you convert a fraction of the non-paying customers into paying, and dump the rest?In which case Amazon would be pulling the plug on themselves as well. I mean, if they did that no one would trust EC2 for critical business apps. Dropbox is paying the rates that Amazon asks for, which is like 10 cents per gigabyte per month, and they even have a 'free tier' now so you don't even have to pay if you don't have much data.
So rather than advertise, they turned their small but loyal customer base into salespeople, giving away 250 megabytes of free storage in exchange for a referral. One-quarter of all new customers still come to Dropbox this way.Yeah given the prices on S3, you're getting 30 cents per year of free service.
Yeah... I read the article earlier and had no idea what they were talk talking about. I assumed they meant the startup screen?Drew Houston... blasted his way onto Apple’s radar screen when he reverse-engineered Apple’s file system so that his startup’s logo, an unfolding box, appeared elegantly tucked inside.I know what a file system is, I know what reverse engineering is, but that sentence doesn't make any sense to me.
I suspect I could corrupt a file in such a way that the checksums are the same as when it was uncorrupted.Really? You think you can break SHA256? Seems... unlikely.
Wait. What? I use a service for work here that does full client-side encryption and there's still web access. The entire decryption engine runs in javascript. The only thing I can't do is a server-side search based on file contents. Whee. It doesn't make the system 100% fool-proof, but it's much farther along the spectrum of security than DropBox.Client side crypto is hypothetically bad because you can change the JavaScript on someone and then get their data if you control the server. But if you don't encrypt the data on the server anyway, then, of course, this doesn't matter because you can get the data anyway. So client side JS is more secure then simply leaving the files unencrypted.
So you're cool with running arbitrary code from a vendor to encrypt your content? I know you can read it. You did audit the code right? And run hashes on it to make sure they don't change to rot13 when you aren't looking? And there's no side channel uploading of the content unecrypted? Or the key?That doesn't make it worse then leaving the data unencrypted.
One thing I've always wondered is: why did webDAV never take off? I've still got graphic designer idiots asking for FTP, and software architects posting on their blog about how great dropbox is. WebDAV seems like it should be perfect: widely supported on major desktops, and HTTP based to sneak through annoying firewalls, and has easily available crypto.Well, FTP, and now SCP work without any configuration. Actually these days I mostly use SCP to transfer files to servers that I'm running because it basically requires zero effort. WebDAV on the other hand, would mean spending a lot of time trying to configure Apache in order to get... what exactly? The ability to upload files, which I already have?
So if I add three seconds of random noise to the end of the movie, or clip the end credits, is it the same file?Uh, no. But if you download a movie off a public bittorent or something like that, then the RIAA will be able to download that same file themselves.
Also — and this is something that the Quora answer completely underplays — Dropbox is quite technically sophisticated. It’s not just rsync on a minute cron, you know. It’s hooking into filesystem interrupts to notice when stuff changes in the synced folder, and doing it natively on every major OS. It’s got quiet but powerful ways of dealing with versioning conflicts. It’s also doing all of this with a high degree of polish (I mean: Growl notifications, c’mon). Plus it’s smart enough to do things like notice when it needs to sync within a LAN instead of over the net, avoiding complexities you might not have considered like NAT traversal. It’s not that it’s so simple; it’s actually a very sophisticated execution. It’s just that those parts aren’t necessarily visible (and no, many of its competitors were not as clever).posted by kenko at 9:39 PM on October 24, 2011
« Older With almost 2,000 posts, I Heart My Art has a deep... | "Long ago Occidental man ... Newer »
This thread has been archived and is closed to new comments
posted by KokuRyu at 2:42 PM on October 24, 2011 [2 favorites]