Dropbox Attempts To Kill Open Source Project

Meskarune writes "Dropbox is trying to kill the Dropship project, a useful program that allows users to import files into their accounts using hashes and bypassing the need to make files public. Dropbox sent out fake DMCA requests to all parties involved, and is banning and censoring the program."

Comments

Is that fraud?

[Sprouticus]

Wouldn't an attempt to intentionally mislead someone with regard to DMCA be regarded as fraud?

Re:Is that fraud?

[drosboro]

Well, intentionality would seem to be missing. As I quoted in a comment below, the update at the bottom of the article now reads as follows:

Update: I want clear up a few things. As far as I’m aware all of the Dropship repositories and archives that were taken down was done so voluntarily. Dropbox never made threats, legal or otherwise. It appears the DMCA notice was automatically sent to me when the file was banned from public sharing. There was no real DMCA takedown issued. It was an edge case bug in their file removal system.

Re:Is that fraud?

[DrgnDancer]

Except if you read the article, only one "fake" DCMA notice was sent out, and it appears to have been a legitimate accident. While the author of the article is not exactly happy with Dropbox's response to this matter he is not nearly as down on it as the summary suggests, and Dropbox's behavior was no near as flagrant as the summary suggests. This is not "nothing", but it's not anywhere near the level of "awful" suggested in the summary. Whole situation is somewhere between "tempest in teapot" and "very mildly concerning".

Re:Is that fraud?

[mcmonkey]

None of which makes me feel any better.

The statement that no threats, legal or otherwise, were made is false. Even if the threats were made accidentally, threats were made. Saying an automated email was kicked off inadvertently does not mean the email was never sent.

Then there's the issue of the mistakenly activated automated email. Why do they have a process that automatically sends out DCMA notices?

Then there's the action of removing the files at issue. I'm not sure how I feel about the selective action on files. If I'm breaking the ToS, why not freeze my account? On the one hand, I can appreciate the effort to not freeze accounts, but at the same time, I don't want the admins at Dropbox going through my files.

Re:Is that fraud?

[Anonymous Coward]

Except if you read the article, only one "fake" DCMA notice was sent out

It wasn't even a DMCA notice. It was an erroneous letter from provider to customer informing customer that the provider received a DMCA notice, when the provider had not (the provider was exercising their privilege of removing the file).

Re:Is that fraud?

[Anonymous Coward]

So this really should read,

    "Blogging Blogger Libels DropBox"

Correct?

Re:Is that fraud?

[Hatta]

It appears the DMCA notice was automatically sent to me when the file was banned from public sharing. There was no real DMCA takedown issued. It was an edge case bug in their file removal system.

There are no edge cases in the DMCA. Either it was a valid DMCA request or it was perjury.

Re:Is that fraud?

[Hijacked Public]

I don't want the admins at Dropbox going through my files.

Don't put them on Dropbox's servers.

Re:Is that fraud?

[NotAGoodNickname]

He is saying that the bug is an edge case, not the DMCA.

Re:Is that fraud?

[Anonymous Coward]

Maybe that's why people are building replacements for Dropbox?

Re:Is that fraud?

[_0xd0ad]

There was never a DMCA takedown notice.

The DMCA takedown notice is what a copyright holder sends to a content host.

The e-mail from the content host to the user saying "we deleted your file because ______" is not a DMCA takedown notice, regardless of what the reason they give.

Content hosts are supposed to notify users whose content has been removed due to DMCA takedown notices so that the users have the opportunity to file counter-notices under the DMCA, but that correspondence is not itself a DMCA takedown notice.

Re:Is that fraud?

[LordLimecat]

It was not a DMCA "request". It was a notification that they were removing the file in order to comply with DMCA Section 512 C-1-c, which indicates "No liability if ... upon obtaining knowledge or awareness, OSP expeditiously removes Work"

In other words, they believed the material to infringe on DMCA, and as the file host, they have the right and duty to remove such a file when they believe it to be infringing. See, Dropbox isnt just the potentially "injured party", they are also the service provider-- and that is the capacity they were issuing the notice in. (NB- IANAL)

Re:Is that fraud?

[DarwinSurvivor]

Libel must be:

1. Written: check
2. Damaging to the reputation of the defendant: check
3. False: check
4. Reasonably known to be false at the time of publishing: FAIL

The further correction makes it even MORE not libel.

Re:Is that fraud?

[Anonymous Coward]

GPG works here.

Re:Is that fraud?

[thsths]

Fraud on who's side? I am pretty sure you are not allowed to (illegally) distribute copyrighted material on Dropbox, using dropship or otherwise.

While I think that dropship is a neat hack, the main use for it seems to be a fast and "free" warez server. And obviously Dropbox cannot support that, for so many reasons. Dropbox offers a great service, for free, and I would like it to stay that way. You use their servers, you play by their rules... simple.

Re:Is that fraud?

[Unequivocal]

Use SpiderOak instead - zero prior knowledge encryption so no one but the password holder can see the files. (My relation to SO is as a non-paying customer).

Re:Is that fraud?

[grub]

Never heard of SpiderOak before, but it looks really interesting. Thanks for posting that!

Re:Is that fraud?

[s0litaire]

+1 for SpiderOak
Used it for over a year.
Never had a problem with them.

Re:Is that fraud?

[icebraining]

Or just use Dropbox's folder as the storage directory for encfs, and then mount it somewhere else - it's what I've been doing.

Re:Is that fraud?

[krazytekn0]

you silly people and your "elements" and "facts" and what not.

Re:Is that fraud?

[WorBlux]

Dear Dropbox User:

We have received a notification under the Digital Millennium Copyright Act (“DMCA”) from Dropbox that the following material is claimed to be infringing.

So they either lied about the existence of the notice, or actually went and delivered themselves the notice.

Re:Is that fraud?

[_0xd0ad]

So they either lied about the existence of the notice, or actually went and delivered themselves the notice.

They either lied about the existence of the notice, or the system simply sent that in error due to an honest mistake on their part. But either way it wasn't illegal.

And they obviously didn't deliver themselves a notice... that would make no sense whatsoever.

Re:Is that fraud?

[FrankieBaby1986]

Can we DOS dropbox with DMCA notices now?

Re:Is that fraud?

[WorBlux]

You can mail yourself a letter, or send a email for yourself, so yes it does make sense. Also there could be one department in say in R$D that could deliver the notice to legal, choosing an clear external process over a murky internal one.

And while not fraud it could very well be negligent. Whenever you know or should have known a process could affect anothe'sr legal rights and possession, you have a duty to take reasonable care to avoid mistakes.

Re:Is that fraud?

[Cramer]

Not quite... Dropbox, as the service provider, does NOT have the right to say what is or is not copyrighted content -- unless they hold the copyright. Under the DMCA (and to claim it as such) they would have to receive a notice from the copyright holder (or their registered agent(s)) pointing out what they believe to be infringing. Dropbox is then obligated to remove those files and notify the user. As the SP, they have no say in the matter -- no matter how obviously incorrect the claim may be, they cannot say "you're full of shit" and ignore it. It's up to the user to file the "you're full of shit" counter claim.

Deleting files and claiming there was a DMCA request when their wasn't isn't covered in the DMCA. It's certainly fraud and misrepresentation of the facts, but legally actionable is open to debate.

Re:Is that fraud?

[currently_awake]

1- All creative endeavors are copyrighted. So the only thing you could upload would be the phone book? Sounds rather useless. I think you meant you can't upload to dropbox without PERMISSION of the copyright holder. 2- if the material was taken off for DMCA request, then they must put it back up if you file a counter notice with the hoster.

Re:Is that fraud?

[_0xd0ad]

No, it would not make sense. It would make no sense for them to send themselves a takedown notice demanding that they take down their own material.

First of all, if they are hosting their own copyrighted material then they are implicitly authorizing that distribution of it, so they can't claim the distribution was unauthorized nor that it was infringing on their copyrights. Secondly, if the material was in fact their intellectual property and they didn't wish to have it distributed in that manner, since they were the ones hosting it they would have simply removed it without any need to invoke the DMCA.

Re:Is that fraud?

[julesh]

Deleting files and claiming there was a DMCA request when their wasn't isn't covered in the DMCA. It's certainly fraud and misrepresentation

It's almost certainly not fraud, as in order to be fraud the incorrect information must be supplied to somebody with hopes of gaining something from them, either money, goods or services, that they wouldn't otherwise provide. As dropbox couldn't possibly have hoped to gain anything (directly) from others by sending such notices, it is at worst a cynical attempt at spreading FUD. Misrepresentation is another matter entirely, but even then I would say it was true only if they intended the recipients of the notices to actually believe them, so if they really were sent accidentally I would still suggest that it is not misrepresentation.

Re:Is that fraud?

[julesh]

One more thing:

As the SP, they have no say in the matter -- no matter how obviously incorrect the claim may be, they cannot say "you're full of shit" and ignore it.

This isn't quite true: they are not under a legal obligation to remove materials that are subject of a DMCA notice, so they can choose to ignore obviously incorrect claims. Doing so is risky, however, as if they are wrong they can become liable for the infringement on behalf of their customer. Most SPs, therefore, choose not to exercise their discretion in any but the most outrageous cases.

Re:Is that fraud?

[Anonymous Coward]

Or you could do what I do -- create a Truecrypt container, put your files in it, and upload to Dropbox. It's not as convenient as direct access to the files, but it ensures privacy and isn't too much extra work. You should probably use separate containers for unrelated files so you don't have to download most of the contents of your Dropbox account just to access one thing.

Re:Is that fraud?

[snemarch]

+1 for that.

People should really check out their blog, it's full of interesting tidbits. It seems SpiderOak are genuinely good guys, with a genuinely good service... even if sync between multiple computers is a bit wonky :)

Disclaimer: I'm using SO, the unpaid version.

Re:Is that fraud?

[silanea]

TFA has been updated to make it clear there was no DMCA takedown attempt. Assuming for a moment that the summary was correct: Dropbox cannot take down any third-party software unless the software itself somehow violates Dropbox's copyright on their own software. The only thing Dropbox can do against Dropship and similar tools is forbid their use in the Dropbox TOS and ban people who use them.

This has nothing to do wih the data stored on Dropbox through such third-party tools: Only the original copyright holder - or apparently someone specifically authorised to act on their behalf, though this was limited in a court case recently discussed here on /. if I recall correctly - of the material stored there can send a DMCA takedown notice - but only for the files, not for the software used to upload them.

So in the situation described in the summary Dropbox would indeed have fraudulently misused the DMCA.

Re:Is that fraud?

[ikegami]

Dropbox, as the service provider, does NOT have the right to say what is or is not copyrighted content

Of course they can. It's not libel, slander or otherwise illegal speech.

If you meant they don't have the right to take down content, that's not right either. The DMCA safe harbours make clear that a site isn't responsible for the actions of 3rd parties, but that doesn't prevent sites from policing their users if they want to, and it doesn't prevent sites from taking down any content they want to from their own sites.

What they can't do is send DMCA takedown requests for content to which they down own the rights. If they did this here, they are in the wrong. Unfortunately, very few face the consequences of sending false DMCA takedown requests.

Re:Is that fraud?

[Anonymous Coward]

More specifically, wire fraud. Has anyone else noticed the lack of enforcement of this sort of crime, or is it just me?

Re:Is that fraud?

[Cramer]

If you meant they don't have the right to take down content, that's not right either. The DMCA safe harbours make clear that a site isn't responsible for the actions of 3rd parties...

That's a matter of their contract with users (i.e. the TOS most people don't even read.) The DMCA safe harbour provisions only apply when the service provider takes timely action to a take down request. Which means exactly what I've already said. (don't take my non-lawyer word for it, talk to your own lawyer. I have.) The SP gets no say in the matter... remove the content, and notify the user. The *USER* can file a counter claim; the SP's only legal course is to remove the content or face charges of infringement.

(Failing to "take action" nullifies the safe harbour and makes the SP legally responsible for the actions of their user(s).)

Re:Is that fraud?

[Stupendoussteve]

SpiderOak is a great alternative, also with the coupon code 'worldbackupday' you get 5GB free up from 2.

Re:Is that fraud?

[WorBlux]

Yes it would make sense. A single corporate body is a fiction. The reality is many different agents acting as it, and often many different principles. You're assuming that there was some formal internal process for that, (not 100% certain) and that is was clearer, more precise than what the DMCA provides (not 100% certain) and that they had no desire for the strong documentation such a formal process can provide for later use to take deal with repeat offenders or internal dissent over the decision. (not 100% certain) . Yes the DMCA would not have been necessary to justify for what they did (the TOS likely says they need no justification whatsoever to do what they did) but that doesn't mean there are no reasons whatsoever to believe there is some posiibility that a DMCA notice may have actually been used. You may find it unlikely, but it is not nonsensical.

Re:Is that fraud?

[_0xd0ad]

Doesn't matter. Any corporate body trying to sue itself would get thrown out of court.

Whatever internal processes they have had better be able to deal with it, because otherwise they have authorized agents doing stuff that other authorized agents don't want them to do.

If you and someone else are joint owners of intellectual property and the other guy decides to post it on the internet free for the taking, guess what? He's authorized to do so, and there's nothing you can do about it.

Fake DMCA request

[partyguerrilla]

Exactly how illegal is this? My guess is "very."

Re:Fake DMCA request

[stonedcat]

Don't worry the MPAA, RIAA, and the IFPI do it all the time so it must be ok.

Re:Fake DMCA request

[_0xd0ad]

Sending a fake DMCA takedown is illegal, yes, but an e-mail that says "we deleted your file due to DMCA takedown notice we received" isn't a DMCA takedown notice. And apparently that e-mail just went out automatically any time they banned a file from someone's account. Apparently it never occurred to whoever designed their system that a file might be removed for anything other than copyright violation... or maybe the admin just didn't select the correct reason when he banned it.

Re:Fake DMCA request

[Anonymous Coward]

Depends. You do live in a plutocracy; how rich are the people involved?

Re:Fake DMCA request

[Anonymous Psychopath]

Exactly how illegal is this? My guess is "very."

How about "not at all". There's nothing "fake" about it. A DMCA takedown notice isn't sent by any government agency. It is simply a claim from a content owner to someone else, usually a content host, claiming that copyrighted content is being illegally published.

Re:Fake DMCA request

[JockTroll]

I live in a laminocracy, where blades disembowel the rich and the poor with equal efficiency. Aye: all piles of steamy, bloody intestines are equal.

Re:Fake DMCA request

[Jaxoreth]

I live in a laminocracy, where blades disembowel the rich and the poor with equal efficiency.

I think I know your architect.

Fake DMCA = illegal, right?

[ehrichweiss]

Or is that merely filing a takedown on false pretenses?

Re:Fake DMCA = illegal, right?

[denis-The-menace]

According to an anonymous comment on the blog:

The perjury provision (17 U.S.C. 512(c)(3)(A)(vi)) applies to persons who submit formal complaints to service providers. It does not apply to informational messages that service providers may send to their users. So even if DropBox had intentionally lied about receiving a DMCA takedown notice (which it didnâ(TM)t; see Arashâ(TM)s comment noting that the DMCA message was mistakenly autogenerated in response to banning the file), it would still not implicate the DMCA perjury provision.

IOW: If you can get ISPs to be your puppets to send "kind" emails to their users, nobody is at fault regardless of the damages done by the emails.

DMCA: Best draconian law you can buy!

Re:Fake DMCA = illegal, right?

[julesh]

nobody is at fault regardless of the damages done by the emails

What damage was done by the emails? They have no legal force, and wouldn't have even if they were sent in response to a valid DMCA complaint. They just notify people that a file has been removed, and tell them how to counterclaim to get the file reinstated if they do have a valid licence to distribute.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Maybe a BIT sensationalistic...

[drosboro]

Okay, according to the update at the bottom of the link (I know, I RTFA, weird, eh?),

Update: I want clear up a few things. As far as I’m aware all of the Dropship repositories and archives that were taken down was done so voluntarily. Dropbox never made threats, legal or otherwise. It appears the DMCA notice was automatically sent to me when the file was banned from public sharing. There was no real DMCA takedown issued. It was an edge case bug in their file removal system.

Apparently, Dropbox is asking nicely, but when they flagged the file it triggered an accidental DMCA notice, for which they seem to be apologizing.

Re:Maybe a BIT sensationalistic...

[xMrFishx]

Why is there even a default DMCA notice in the system in the first place? Surely these things should be manually handled, rather than essentially "spammed" out. This is the sort of realm of Auto-Lawsuits where everyone got a letter through their mail box. This sort of thing should not be automatic in any sense of the word.

Re:Maybe a BIT sensationalistic...

[Anonymous Coward]

Why not? We spam car drivers with automated speeding and red light tickets.

Re:Maybe a BIT sensationalistic...

[0100010001010011]

VIA post at slashdot.org

Re: Copyright Claim

The Slashdot Hosting Company:

I am the copyright owner of the post being infringed at:

http://news.slashdot.org/comments.pl?sid=2105778&cid=35944048

Copies of the post being infringed are included to assist with their removal from the infringing Web sites.

This letter is official notification under the provisions of Section 512(c) of the Digital Millennium Copyright Act (“DMCA”) to effect removal of the above-reported infringements. I request that you immediately issue a cancellation message as specified in RFC 1036 for the specified postings and prevent the infringer, who is identified by its Web address, from posting the infringing photographs to your servers in the future. Please be advised that law requires you, as a service provider, to “expeditiously remove or disable access to” the infringing photographs upon receiving this notice. Noncompliance may result in a loss of immunity for liability under the DMCA.

I have a good faith belief that use of the material in the manner complained of here is not authorized by me, the copyright holder, or the law. The information provided here is accurate to the best of my knowledge. I swear under penalty of perjury that I am the copyright holder.

Please send me at the address noted below a prompt response indicating the actions you have taken to resolve this matter.

Sincerely,

0100010001010011

Re:Maybe a BIT sensationalistic...

[drosboro]

Presumably because the requirements of the DMCA legislation in the US is so onerous on services like Dropbox that an automated system is the only reasonable way to go. I'm not sure, being a Canadian (and waiting with great anticipation for our new government to slap our own version of the DMCA down on us)...

Seems to me that if I were the coder in question, I might be tempted to say "okay, the only reason we're ever going to block anything from public sharing is because someone filed a DMCA complaint... so let's just fire off the automatic notification when we block the file. There, three lines of code and a template email, and I can go grab a coffee". Yes, it's a shortcut, but it's also not completely out-of-the-realm-of-reasonability.

Re:Maybe a BIT sensationalistic...

[SomePgmr]

Given the rate at which Dropbox must handle takedowns on a "host whatever you want on the innerwebs, easily" service... I'm not at all surprised that their ban button sends takedown notices automatically. Until now, they've likely only had to ban files for precisely that scenario, with minor exceptions.

Or from a programmers point of view: If 99.9% of the time B follows A, automate B. Handle the .1% manually as edge cases.

Re:Maybe a BIT sensationalistic...

[0100010001010011]

Oh shit. Sorry about that. I don't know what the system was thinking.

Re:Maybe a BIT sensationalistic...

[xMrFishx]

Whilst I see your point, I'd figure the system should have multiple messages depending on severity/reason rather than one $law that may or may not apply message, especially with implications of said law.

Re:Maybe a BIT sensationalistic...

[_0xd0ad]

Maybe it did and the admin forgot to tick the non-default reason. Who knows... all that really matters is that it does appear to have been an honest mistake.

Re:Maybe a BIT sensationalistic...

[Anonymous Coward]

That's okay. I'm sure xMrFishx can still get Righthaven to sue you on his behalf.

Re:Maybe a BIT sensationalistic...

[ChrisMounce]

0100010001010011 = DS? I don't get it (DropShip?), but it doesn't seem like coincidence (multiple of 8 bits, both uppercase ASCII chars).

Re:Maybe a BIT sensationalistic...

[starwed]

For some reason this topic has built up an epic level of FUD.

Their system was designed to be used in response to DMCA notices. Dropbox would get a takedown notice, they'd flag the file to be removed, and an e-mail would be sent to the uploader of the file informing them of the DMCA notice.

In this case, a dropbox guy used the tool without realising that the last step was automated. There was never any DMCA notice generated, just a DMCA notice notice.

Re:Maybe a BIT sensationalistic...

[_0xd0ad]

His initials, more likely, but still an awesome coincidence.

Re:Maybe a BIT sensationalistic...

[Zeikzeil]

I wouldn't be surprised if you were right. If so, unless they're already gone, the coder in question should probably be fired for failing to run that by the lawyers first.

What makes you think that didn't happen?

Re:Maybe a BIT sensationalistic...

[DarwinSurvivor]

Or whoever wrote the SPECIFICATION he/she was implementing. Coders are about the last person the company lawyer is going to spend their well funded time talking to.

Re:Maybe a BIT sensationalistic...

[Wannabe Code Monkey]

Apparently, Dropbox is asking nicely, but when they flagged the file it triggered an accidental DMCA notice, for which they seem to be apologizing.

Alright, but why was the file even flagged for take down at all. It didn't violate any copyright, or any other law. It's just because Dropbox didn't like it. They shouldn't be removing or flagging files and users for things they just don't like (DMCA take down notice or not).

Re:Maybe a BIT sensationalistic...

[0100010001010011]

Yep. My screen name for 90% of the web was taken by time I got around to registering for /.. Most people just shortened it on IRC to ds: when they needed me, so ds in ASCII it was.

Re:Maybe a BIT sensationalistic...

[_0xd0ad]

Actually they can take down any file that violates their terms of service.

Re:Maybe a BIT sensationalistic...

[farble1670]

Surely these things should be manually handled, rather than essentially "spammed" out.

probably because there are many, many such violations and they couldn't possibly hire enough people to look into each of them personally.

Re:Maybe a BIT sensationalistic...

[cusco]

The lawyer should ALWAYS be fired first. Preferably by firing squad. Then take that paycheck and double the salaries of 27 people who do real work.

Re:Maybe a BIT sensationalistic...

[Alarash]

In a recent blog entry, Dropbox explained that they get about one request a month from the US government to pass over files :

Just so you know, we don’t get very many of those requests — about one a month over the past year for our more than 25 million users. That’s fewer than one in a million accounts.

But that's only for cases where the government requests data on their servers. We don't know how many requests they get because some stupid ass put the latest Lady Gaga CD in this /public/ folder and posted the link on 4chan. And I'm guessing it's a lot. In fact, I'm surprised that Dropbox hasn't been sued by the majors yet.

What is "legal"

[Anonymous Coward]

"Legal" is about filing the right paperwork.

Are they fake though?

[O('_')O_Bush]

I mean, from the FA, it talks about how Dropship is exploiting the Dropbox hashing algorithm, which might be copyrighted along with the rest of Dropbox (I don't know). If it was, then I could see why there would be grounds for copyright infringement, unless the OSS project could demonstrate that it arrived at that dropbox hashing algorithm through blackbox testing.

Re:Are they fake though?

[Jonner]

I mean, from the FA, it talks about how Dropship is exploiting the Dropbox hashing algorithm, which might be copyrighted along with the rest of Dropbox (I don't know). If it was, then I could see why there would be grounds for copyright infringement, unless the OSS project could demonstrate that it arrived at that dropbox hashing algorithm through blackbox testing.

Thankfully, copyright does not apply to algorithms and the US has a legal system based on the idea that people are innocent until proven guilty.

Re:Are they fake though?

[gstoddart]

Thankfully, copyright does not apply to algorithms

And, the DMCA has an explicit exception for interoperability and such, which I think this would be covered under.

the US has a legal system based on the idea that people are innocent until proven guilty.

Unless one is suspected of copyright infringement, kiddie porn or terrorism, then it's straight on to the presumption of guilt and you needing to prove you didn't do it.

Sadly, it seems like those three can pretty much bypass any court oversight.

Re:Are they fake though?

[Jonner]

Thankfully, copyright does not apply to algorithms

And, the DMCA has an explicit exception for interoperability and such, which I think this would be covered under.

I think you're confused. Perhaps you're thinking of the anti-circumvention clause which clearly doesn't apply in this case. Dropbox is not claiming copyright infringement and seems to have admitted that the DMCA takedown notice was a mistake. They are claiming that using Dropship violates their terms of service, which it probably does. However, the DMCA has nothing to say about that since it is not at all related to copyright.

Even if the DMCA's anti-circumvention clause applied, it still doesn't change the fact that you cannot copyright an algorithm. Unfortunately, you can patent one.

the US has a legal system based on the idea that people are innocent until proven guilty.

Unless one is suspected of copyright infringement, kiddie porn or terrorism, then it's straight on to the presumption of guilt and you needing to prove you didn't do it.

Sadly, it seems like those three can pretty much bypass any court oversight.

What you're describing certainly happens, but is a gross violation of the principles of the legal system. The post I responded to seemed to be implying that it was reasonable to assume that a work infringed on a copyright until it was proven non-infringing.

Re:Are they fake though?

[gstoddart]

I think you're confused. Perhaps you're thinking of the anti-circumvention clause which clearly doesn't apply in this case.

Not confused, maybe interpreting it differently ...

He outlined his objections, that Dropship reveals their proprietary client-server protocol and that it could be used for piracy.

Revealing their "proprietary client-server protocol" is part of the issue here, and we have explicit rights to reverse engineer a protocol. I'm not sure on what basis Dropbox can really keep their protocol secret.

The second half of the "could be used for piracy" is the only tenuous link to the DMCA. And, as the article said, the whole DMCA part is a red herring. Basically it says that since you might use the posted technique to perform copyright violations, the whole thing needs to go.

Even if the DMCA's anti-circumvention clause applied, it still doesn't change the fact that you cannot copyright an algorithm.

Yes, this is me agreeing with you that you can't copyright an algorithm, as I initially did ... and pointing out that in terms of interoperability, even if you could copyright one, there are explicit exemptions that allow you to reverse engineer to be able to work with it. There isn't even anything to do with "circumvention" in this case -- they didn't bypass passwords or DRM.

What you're describing certainly happens, but is a gross violation of the principles of the legal system.

Depressing, isn't it? And yet, it seems to be becoming the norm in terms of how this is done. Send a DMCA notice, regardless of merit, and it is expected to be acted upon without any evidence. Merely an assertion. Who needs the principles of the legal system when you can screech loud enough about copyright infringement to go straight to enforcement on the say-so of a lawyer?

The post I responded to seemed to be implying that it was reasonable to assume that a work infringed on a copyright until it was proven non-infringing.

Which is the exact same logic the *AA's use, and apparently the basis for the "three strikes" laws being enacted in many countries.

It's not reasonable, but that seems to be how it's being done. :(

Re:Are they fake though?

[LordLimecat]

The implementation of an algorithm, however, CAN be copyrighted, which Dropbox IS.

As for that "innocent til proven guilty", where does it say that the blogger was convicted of anything? This hasnt even gone to court; "innocent till proven guilty" has absolutely nothing to do with it. Dropbox is the service provider, and thus has the explicit right under DMCA to remove all material it believes to be infringing (as does, for example, Youtube).

Re:Are they fake though?

[muffen]

and the US has a legal system based on the idea that people are innocent until proven guilty.

Funny, before coming to slashdot I was reading NYTimes, about an afghan farmer being imprisoned for a few years because he had a pair of binocular on him.

Re:Are they fake though?

[TooMuchToDo]

Did you just try to argue that MD5/SHA hashing is copyrightable? Sir, your nerd/geek card is revoked. (And yes, Dropbox uses one of those hashing algorithms).

Re:Are they fake though?

[HiThere]

WRT "innocent til proven guilty":
That only applies to criminal offenses, not to civil suits. Civil suits are decided on "the preponderance of the evidence". There is not supposed to be any presumption of either innocence or guilt.

P.S.: Effectively this usually means that the rich person will win, but it may cost him. And that statement is only true if there's a large discrepency in their wealth. Otherwise it's likely to be a crap-shoot.

Re:Are they fake though?

[LordLimecat]

Innocent until proven guilty applies even in civil suits. The onus is still on the opposing party to prove (just, to a different extent than criminal) that you are guilty. The difference is in the level of certainty required before conviction; there are very very few courts which will admit to being "guilty until proven innocent", since it would then be trivial to wreck someone's life with accusations that they would then be forced to disprove.

"Useful"

[AdmiralXyz]

Useful though it may be, it's very clearly against Dropbox's Terms of Service. That doesn't give them the right to issue takedown notices to other sites on copyright grounds, but let's separate, "evil for issuing fake takedown notices" (which they are), from "evil for wanting to prevent this kind of activity" (which is perfectly reasonable).

They're not running a filesharing service, that's not their business model, and they don't want to end up like Rapidshare or any of the N other filesharing services in legal hot water. I love Dropbox, and I would hate to see one of it's most useful features- public collaboration folders- shut down because some asshats can't obey the TOS and just use torrents instead. Dropbox should be trying to find a technical solution to block something like this, but if that's not possible, what can they do?

Re:"Useful"

[DrgnDancer]

It also appears that the take down notices are a mistake, and Dropbox is apologizing for them.

Re:"Useful"

[_Sprocket_]

That doesn't give them the right to issue takedown notices to other sites on copyright grounds...

I don't believe that's what happened.

Re:"Useful"

[Anonymous Coward]

They're not running a filesharing service, that's not their business model, and they don't want to end up like Rapidshare or any of the N other filesharing services in legal hot water. I love Dropbox, and I would hate to see one of it's most useful features- public collaboration folders- shut down because some asshats can't obey the TOS and just use torrents instead. Dropbox should be trying to find a technical solution to block something like this, but if that's not possible, what can they do?

A technical solution isn't the right way to go about this. What we need is a legal solution; fix the law which invented a problem that wasn't there and then consider murdering the fuckwit who made it up in the first place.

Re:"Useful"

[LordLimecat]

Who cares, its not like anyone is going to read the article anyhow. This is too juicy of a chance to rail about copyright, the government, and corporations.

Re:"Useful"

[am 2k]

I love Dropbox, and I would hate to see one of it's most useful features- public collaboration folders- shut down because some asshats can't obey the TOS and just use torrents instead.

The shared folder feature is not the problem. The problem is that the client only sends a hash of the file to the server to check whether the server already has that file in its global database. If this is the case, it doesn't have to be uploaded. I experienced that when I put a ~2GB file into my Dropbox, and it synced within a second (and no, I don't have a fast Internet connection). Somebody else has the same file in a Dropbox, and so the server already knows about that hash.

What the hack does is pretend that a certain file with a certain hash is there when it's not, and then letting the client resync (and thus, download that file from the global database to the local Dropbox).

The big problem is that this flaw is inherent in the way Dropbox works, and there's nothing technical they can do about it without rewriting their whole concept and implementation from scratch (and copy the concepts of wuala for example). Their whole business plan is based around the fact that they do deduplication on the server, and thus the only relevant cost is network transfer (which is very cheap).

Re:"Useful"

[_Sprocket_]

The irony is that there's enough going on with those subjects to not (mistakenly or otherwise) make up additional events.

Re:"Useful"

[TooMuchToDo]

They actually do de-duplication on the backend in Amazon's S3, to save on storage costs. Most likely they also cache heavily used files on their infrastructure that sits between Amazon and the end user.

Re:"Useful"

[wagnerrp]

The problem is that the client only sends a hash of the file to the server to check whether the server already has that file in its global database. If this is the case, it doesn't have to be uploaded. I experienced that when I put a ~2GB file into my Dropbox, and it synced within a second (and no, I don't have a fast Internet connection). Somebody else has the same file in a Dropbox, and so the server already knows about that hash.

This seems like an intrinsically bad idea. Regardless of the hashing algorithm, there exists a possibility of a collision. Let's say you sync a file, a matching hash is found on the system, and instead of uploading your copy, they simply add that file to your account. That matching hash is not your file. You delete your local copy of the file, and that data is now lost. The only time I can think of that I could legally be uploading a duplicate file of any consequential size would be bit-accurate CD and DVD ISOs.

They can do de-duplication if they want, but it should be done server side with a direct comparison between the two files, not just a hash.

Re:"Useful"

[am 2k]

They can do de-duplication if they want, but it should be done server side with a direct comparison between the two files, not just a hash.

Yes, they probably didn't think Dropbox would take off like that... The whole concept has its issues with scaling and exposure.

Re:"Useful"

[atamido]

Regardless of the hashing algorithm, there exists a possibility of a collision.

For any modern cryptographic hashing algorithm, the only possibility of a collision is to create one on purpose, and for modern ones there haven't been methods invented to do this. IE, it's impossible as long as they routinely update their hashing algorithm (which is easy as they can produce new hashes of the files they have, and force a minimum client version for new files. When you have as many possible combinations as there are atoms in the universe, you're more likely to win every lottery for a year than to have an accidental collision.

MD5 hasn't been secure for a few years, but it relatively ancient, being created in 1991. SHA-512 has no known vulnerabilities, and a new candidate for SHA-3 will soon be chosen. Heck, they could hedge their bets and use two different hashers to in case one is ever broken.

The only real danger is if you already knew the hash of a file, you could retrieve it. Of course, the

Re:"Useful"

[wagnerrp]

For any modern cryptographic hashing algorithm, the possibility of any two hashes colliding is astronomically low. Dropbox hashes in blocks a maximum of 4MB. That means for hundreds of terabytes of stored space, you're looking at tens to hundreds of millions of stored hashes. The number of permutations of those millions of hashes brings a hash collision into the realm of statistical possibility. It has nothing to do with vulnerabilities. Of course since those are SHA-512 hashes, with some 10**150 possibilities, it's probably not something they'll have to worry about.

I still contend that hashes should only be used to determine if two items are different, not as the sole confirmation that they are the same.

possible mistake

[cencithomas]

From TFA:

Update: I want clear up a few things. As far as I’m aware all of the Dropship repositories and archives that were taken down was done so voluntarily. Dropbox never made threats, legal or otherwise. It appears the DMCA notice was automatically sent to me when the file was banned from public sharing. There was no real DMCA takedown issued. It was an edge case bug in their file removal system.

So, still stupid, but at least there's the possibility that it wasn't malice.

Re:They weren't "fake"

[Anonymous Coward]

Indeed, and it appears that the notice was not intentional. From the FA,

Update: I want clear up a few things. As far as I’m aware all of the Dropship repositories and archives that were taken down was done so voluntarily. Dropbox never made threats, legal or otherwise. It appears the DMCA notice was automatically sent to me when the file was banned from public sharing. There was no real DMCA takedown issued. It was an edge case bug in their file removal system.

where's the firehose

[penguinchris]

Vote this article down - it's misleading flamebait in the extreme. In particular, it fails to mention that the software was designed to facilitate anonymous filesharing, which would most certainly be used for copyright infringement and illegal purposes. And, the whole thing goes against Dropbox's TOS, even if it isn't used for dubious file sharing purposes.

Re:where's the firehose

[Gaygirlie]

Vote this article down - it's misleading flamebait in the extreme. In particular, it fails to mention that the software was designed to facilitate anonymous filesharing, which would most certainly be used for copyright infringement and illegal purposes. And, the whole thing goes against Dropbox's TOS, even if it isn't used for dubious file sharing purposes.

Agreed. The TOS is pretty darn clear on this and as such there is no reason to complain, they are fully in their rights to do this.

Re:where's the firehose

[h4rr4r]

Or maybe people just want to share files privately. Not everyone wants to make their files public to share them.

Everything these days is "Oh noes, teh illegal stuffs", get fucking over it. Baseball bats have lots of illegal uses, no one fights the sales of those.

The TOS violation is the only thing that matters here. It is also why I never used dropbox and never will. I will keep my own files on my own server thank you.

Re:where's the firehose

[Jonner]

Vote this article down - it's misleading flamebait in the extreme. In particular, it fails to mention that the software was designed to facilitate anonymous filesharing, which would most certainly be used for copyright infringement and illegal purposes.

Yeah, anonymous file sharing has no legitimate purposes whatsoever.

Re:where's the firehose

[Dot.Com.CEO]

Do you really think linux / oss torrents account for anything over 1% of bittorrent traffic?

Re:where's the firehose

[mini me]

which would most certainly be used for copyright infringement and illegal purposes.

So much for innocent until proven guilty.

Re:where's the firehose

[Anonymous Coward]

Vote this article down - it's misleading flamebait in the extreme. In particular, it fails to mention that the software was designed to facilitate anonymous filesharing, which would most certainly be used for copyright infringement and illegal purposes. And, the whole thing goes against Dropbox's TOS, even if it isn't used for dubious file sharing purposes.

Agreed. The TOS is pretty darn clear on this and as such there is no reason to complain, they are fully in their rights to do this.

Not particularly - there is a section on 'reverse engineering', but frankly from my (limited) understanding of this, it qualifies as such only in the sense that figuring out the URL scheme for a website qualifies as reverse engineering. Going by that my understanding Salesforce object ID's qualifies me as a hacker.

Having an IQ and noticing a pattern is not a TOS violation.

Pug (anon due to mod points in play - and btw we need a +1 "Wrong, but worth arguing about" option - {G}.

Re:where's the firehose

[Jonner]

According to some, 90% of all email is spam. Does that make SMTP an illegitimate protocol? Often, the easiest way to find copyright infringing works is using Google. Does that make the search engine illegitimate? Porn drove early VCR development. Is VHS an illegitimate technology?

Re:where's the firehose

[Dot.Com.CEO]

I was talking specifically about torrents.

Re:where's the firehose

[Anonymous Coward]

"Or maybe people just want to share files privately. Not everyone wants to make their files public to share them."

Then use a different service.

Re:where's the firehose

[LordLimecat]

Er, "innocent until proven guilty" refers to court cases. This hasnt gone to court. How is that statement even remotely relevant?

Re:where's the firehose

[Anonymous Coward]

For one, if you want to share files privately, DON'T USE DROPBOX. For two, I don't think that people are crying about how wrong the "illegal stuffs" are, but rather that Dropbox doesn't want to risk getting their asses sued off for it. Pretty simple.

Re:where's the firehose

[Anonymous Coward]

And if you want to do it, feel free, but why should Dropbox be forced to pay for it with their bandwidth? If you want to do it, use another service.

Re:where's the firehose

[xMrFishx]

I was talking specifically about torrents.

No, jonner's point is still valid. It's just a protocol.

Re:where's the firehose

[blueg3]

Dropbox already lets you share files privately. Just not in this particular manner.

I have Dropbox on this machine with a handful of shared folders from other Dropbox users.

Re:where's the firehose

[mini me]

While you are correct that the statement is most commonly used in court, it holds meaning outside too. The parent has accused people of breaking the law, including those who have no intention of doing so. He is not legally required to presume them to be innocent, but it is customary to give people the benefit of the doubt.

Re:where's the firehose

[Anonymous Coward]

You gave three examples for legitimate uses of file sharing. No one is doubting that file sharing has legitimate uses. Dropbox's entire model is based around file sharing and they explicitly encourage users to share files. What we're talking about is anonymous file sharing. Do you have any examples of legitimate uses file sharing where anonymity is strictly necessary?

Re:where's the firehose

[element-o.p.]

Baseball bats have lots of illegal uses, no one fights the sales of those.

Yet...

Re:where's the firehose

[Jonner]

I have no intention of using Dropbox and would not support those who violate its terms of service in any way. I was just pointing out the logical fallacy of dismissing all issues related to anonymous file sharing simply because it can be abused.

Re:where's the firehose

[idontgno]

While you are correct that the statement is most commonly used in court, it holds meaning outside too.

No, it doesn't. Anyone who's ever seen an innocent person convicted in the kangaroo court of public opinion and spend the rest of their life in a futile attempt to recover their ruined reputation would never blithely mouth empty sentiments like that.

In truth, the "outside of court" mantra is "guilty even if found innocent".

Re:where's the firehose

[element-o.p.]

And Jonner gave multiple examples of why your arguments failed by pointing out parallel cases in other technologies that we all pretty much understand to be useful. Your claim seems to be that torrents are not a useful protocol/technology because the predominant use of that technology is illicit. Jonner points out several other protocols/technologies that ALSO have (or at least, at some point in time, HAD) a predominately illicit use, but which are generally accepted. Consequently, pointing out that a protocol/technology is predominately (ab)used for illicit purposes is NOT a valid measure of whether or not the protocol or technology is "good" or "bad".

I would take the argument a step further and say that a protocol or technology CANNOT be inherently "good" or "bad" but rather only the uses one make of it are "good" or "bad". Even if only 1% of bittorrent traffic is used for legitimate purposes like Linux or other FOSS, that proves that bittorrent has a legitimate use and consequently should not be restricted.

Re:where's the firehose

[Jonner]

Participating in a torrent is somewhat anonymous in that your peers' identities are not obvious. However there are much stronger anonymizing systems, such as Tor. They list many legitimate users, which may be sending messages, browsing the web or sharing files through Tor.

Even more comprehensive is Freenet, which is used to get around censorship in places like China.

Re:where's the firehose

[icebraining]

How is this anonymous? You still need to have an account on Dropbox.

Re:where's the firehose

[Anonymous Coward]

Slashdot has no 'voting' an article down. Instead, you just yell at the retarded editors.

Re:where's the firehose

[rjstanford]

First, there's a difference between 20% useful legit content and .0002% useful legit content, at least in the real world.

Even if only 1% of bittorrent traffic is used for legitimate purposes like Linux or other FOSS, that proves that bittorrent has a legitimate use and consequently should not be restricted.

Hmm. Not so much, I'm afraid. If you take that argument to its conclusion, everything (absolutely everything) should be permitted, because you can always find some legitimate use for it. I'm a huge fan of the ideas behind Bittorrent, but I won't try to argue that the vast majority of the service is used for illegal fileswapping. I also wouldn't advocate for its banning (if that was even possible), but I completely understand why organisations who feel that they're legally liable for infringing content moving across their networks would themselves attempt to ban it.

Re:where's the firehose

[mcvos]

Agreed. The TOS is pretty darn clear on this and as such there is no reason to complain, they are fully in their rights to do this.

In their full rights to do what exactly? Ban users? Sure. But threatening/faking DMCA takedowns? Not really. Of course they're in their full rights to ask people nicely not to do this, but it's too late. Cat's out of the bag.

Re:where's the firehose

[mcvos]

I noticed Ubuntu in the download top 10 of a torrent site. I admit I was surprised, but it was there.

Not "fake" DMCA requests

[g051051]

If you read the article, the claim is that the DMCA request was a mistake, not "fake". Big difference there!

Re:Not "fake" DMCA requests

[Rob the Bold]

If you read the article, the claim is that the DMCA request was a mistake, not "fake". Big difference there!

Fair enough. But with a weapon as powerful as the DMCA, extra caution is warranted when using it. "I didn't know the gun was loaded . . ." isn't something you want to have to say.

Re:Not "fake" DMCA requests

[_0xd0ad]

The DMCA was never invoked, because there was never an actual DMCA takedown notice, just a form e-mail that stated that his file had been deleted because of a DMCA takedown notice. There wasn't a DMCA takedown notice and his file wasn't deleted because of one - it was deleted for an entirely different reason - but apparently that same form e-mail was set to go out to anyone whose file was deleted by an admin for any reason at all.

A DMCA takedown notice is what a copyright holder would send to DropBox, not what DropBox would send to its user after deleting the file from their servers.

Re:Not "fake" DMCA requests

[h4rr4r]

So they perjured themselves by accident?

Seems like courts would frown on that sort of thing.

Re:Not "fake" DMCA requests

[_0xd0ad]

They didn't issue a DMCA takedown notice (which would have been perjury). They claimed that they had received one, which is either simply lying or an honest mistake.

Re:Not "fake" DMCA requests

[Martin Blank]

It wasn't deleted in any case. Access to it was blocked, and the CTO reversed the block after conversing with the post's author. The CTO requested that he remove it, but did not demand that he do so.

Re:Not "fake" DMCA requests

[_0xd0ad]

True - not that it makes a whole lot of difference, though. "Lazy" delete is pretty common, so at what point do you want to say it was deleted? When they set the "deleted" bool on the database record for the file that's good enough to call it deleted from the user's point of view. Chances are they could get it back even if it really was deleted if they went down to undelete it at the filesystem level or if they did any sort of regular backups.

Re:Not "fake" DMCA requests

[Anonymous Psychopath]

They didn't issue a DMCA takedown notice (which would have been perjury). They claimed that they had received one, which is either simply lying or an honest mistake.

Perjury is lying under oath during a judicial proceeding. This would not have been perjury.

Re:Not "fake" DMCA requests

[_0xd0ad]

Sending a DMCA takedown notice which asserts that you are the owner of content which you don't actually own is, in fact, perjury.

Re:Not "fake" DMCA requests

[Martin Blank]

I'm not sure if you're trying to argue semantics here, but nowhere in the article does it say that it was deleted, soft or otherwise. The e-mail sent to him said that DropBox had "removed or disabled access to the material" and that "public sharing on your account has been disabled." Arash Ferdowski restored the access to the public files and requested that the author delete the file in question. No one deleted the file. Permissions were changed. That's not even remotely the same thing as deletion.

Re:Not "fake" DMCA requests

[_0xd0ad]

The e-mail sent to him said that DropBox had "removed or disabled access to the material"

There you go. They either "removed" the material (i.e. deleted it) or they "disabled access" (i.e. lazy delete). From a user's point of view, it's not much different: you can't access it.

I'm trying not to argue semantics. The point was that they took down the file. Whether they deleted it (which was the word I originally used) or whether "access to it was blocked" is fairly irrelevant to the discussion.

Mirror, mirror...

[VGPowerlord]

Gotta love how the guy is still hosting Dropship, just not on Dropbox itself.

Don't be surprised if his Dropbox account gets yanked for real this time, and some sort of lawsuit follows.

Meh

[Haedrian]

I'm with dropbox on this one. The idea of converting dropbox into some sort of filesharing/torrent service, for passing potentially illegal files around is not good.

I can see why Dropbox doesn't want to be linked to such a thing, when the big media people come a knocking, who do you think is going to end up getting sued?

And just because its open source doesn't make it right, or wrong, or change anything.

Re:Meh

[VGPowerlord]

I can see why Dropbox doesn't want to be linked to such a thing, when the big media people come a knocking, who do you think is going to end up getting sued?

The end user, as Dropbox will duck behind the DMCA.

Re:Meh

[Jonner]

Enforcing terms of service is one thing, but making bogus accusations and trying to get the software censored outside of Dropbox is another. This is a lot like the deCSS situation, in which copyright holders tried to censor the software rather than prosecute actual copyright infringement.

Re:Meh

[Haedrian]

That sure worked for the tons of other cases when sites were taken down.

Re:Meh

[Graham J - XVI]

who do you think is going to end up getting sued?

My grandmother?

Oh, right.

Re:Meh

[Anonymous Coward]

Some of the files are potentially legal too.

Innocent until proved guilty, remember?

Re:Meh

[dbIII]

The idea of converting dropbox into some sort of filesharing/torrent service, for passing potentially illegal files around is not good.

That's what happened to anonymous FTP so that's what this bastard reinvention of FTP is facing. We need stuff like this to be killed off by easy end to end sftp or similar instead of having to rely on somebody in the middle kludging something together. The question is really how do we get an easy to use sftp program to be as ubiquitous as Winzip used to be?

Re:Meh

[Haedrian]

You can easily use the public files instead. When I want to distribute something to my friends, that's what I do. This however requires you to put the file in the 'public' folder, which is proof you intended to share it.

However, this way they 'steal them off your account'. So there's no real repudiation. "No, I didn't give fileshare that illegal file, I just kept a backup for myself and someone stole it from my account or something"

Re:Meh

[allo]

you still can share illegal files, and as dropbox does not know if you have bought them, they should not be allowed to delete them. even if you share them with friends.

they just do not want you to "upload" a file with only providing the hash. if the file is "illegal" or not is not given by the fact you "speed-upload" it.

Encryption?

[PunchMonkey]

Dropbox states that all files on their servers are encrypted. I had assumed this meant the key was encrypted with your own password, but this exploit suggests that the files either are not encrypted, or encrypted with a freely accessible key.

From: https://www.dropbox.com/help/27
"All files stored on Dropbox servers are encrypted (AES-256)"

Re:Encryption?

[h4rr4r]

If they used real encryption they would have to host files over and over again. Encryption breaks file deduping. No way is dropbox going to do something like that, there is no advantage in it for them.

Re:Encryption?

[wastedlife]

The files are encrypted, but Dropbox holds the key. This is how you can access the files through the website and share folders directly with other Dropbox users. It means that your files are susceptible to intrusion, so encrypt anything secret yourself before sending to Dropbox. Truecrypt volumes do work in Dropbox because it uses a block cipher(only changed blocks are synced, not the whole volume), but you do need to disable the option to not update modification timestamp in order for syncing to work. KeePass 2.x encrypted databases also work well, unfortunately KeePassX does not support writing to KeePass 2.x databases as of now.

On topic, the headline and summary are blowing this way out of proportion. Dropship fakes the hashing algorithm to make Dropbox think you have a file that you don't. Dropbox already supports both public links for files and folders, and can also privately share folders between accounts. I don't know of any legitimate purpose for Dropship that isn't covered by built-in features.

Re:Encryption?

[Jonner]

It's already been shown that Dropbox's claims about security are mostly bogus. If Dropbox can Hand Over Your Files to the Feds If Asked then the encryption method they use to store files on their servers is meaningless since they have the private keys anyway.

Re:Encryption?

[pmontra]

I agree that they don't encrypt data in any safe way. They're exposing the weakness of their security algorithms. This is the third /. post about different problems with Dropbox in a month. Here are the first one and the second one. Definitely not a server one should upload anything to before having encrypted it.

Re:Encryption?

[Anonymous Coward]

As I understand it, file uploads are a two step process:
1. The client generates a fingerprint for the file and sends this to the server
2a. If the server already has a file with that fingerprint, it just tells the client, "Thank you, I've got it," links the file to the user's account, and pretends that it was uploaded.
2b. If the file is new, it is uploaded, encrypted, and stored.

Dropship is essentially an alternative client that fakes the fingerprint to trigger scenario 2a, without ever having had the file locally.

The actual file contents are still encrypted. But, as recent kerfuffles have pointed out, this encryption uses a key owned by Dropbox - not a private key that you can manage/secure yourself.

Personally, I think this is a reasonable measure of security for the service.
* You get a very clean client and fairly robust feature set that would be much more difficult or impossible with perfect security.
* Your data is protected against casual wandering eyes or someone hacking into the underlying S3 storage (or whatever they're using now).
* You're still open to a deliberate effort by a Dropbox insider with sufficient privileges, government subpoena (or angry letter), and uncommon stupidity / freak accidents.

For the kinds of files I share with Dropbox, this is perfect. Anything else, I either keep to myself or (as Dropbox recommends) stick inside a TrueCrypt volume before giving away.

Re:Encryption?

[LordLimecat]

It is likely that your password grants you access to the encryption key-- that way if you lose your password, you can reset it without losing access to all of your files.

Re:Encryption?

[LordLimecat]

Of course they have the private keys. How else would they be able to do password recovery?

Re:Encryption?

[Anonymous Coward]

there are other services with better security.

Re:Encryption?

[Anonymous Coward]

If they used real encryption they would have to host files over and over again. Encryption breaks file deduping. No way is dropbox going to do something like that, there is no advantage in it for them.

You are misleading people. The clients may not be encrypting uploaded data, but that doesn't make whatever backend encryption is going on less "real". Only encrypting at the source breaks dedupe.

There is nothing disingenuous about what Dropbox claims, but you however...

Re:Encryption?

[Anonymous Coward]

It's already been shown [tirania.org] that Dropbox's claims about security are mostly bogus. If Dropbox can Hand Over Your Files to the Feds If Asked [pcworld.com] then the encryption method they use to store files on their servers is meaningless since they have the private keys anyway.

When the hell did "security" take on the extra meaning "from the state" ??!1
These are the smash in the door and take everything including your ass for questioning folks.

You can not realistically say that because "the Feds can legally get it" something is insecure. If not your state, than another one can. Period. That's the nature of the real World; some people have more power than you. Why don't you wake up?

Re:Encryption?

[TooMuchToDo]

The only thing they may be remotely using -256 is SHA. Note how if you dump a show from bittorrent (Say, The Daily Show from last night) into your Dropbox folder, it's immediately hashed, and shown as available with no upload necessary. Yeah, it's because someone else put it in their Dropbox folder first, and it's already stored and hashed on the backend in Amazon S3.

Re:Encryption?

[h4rr4r]

Encrypting after dedupe breaks the whole point of encryption. It means every copy of the same file is encrypted the same way. That means I can tell who has what files. At that point you are encrypting only to claim you do it.

Re:Encryption?

[Jonner]

I've never used Dropbox and never will with what I know now, so I wasn't aware they could do password recovery. It seems that Dropbox has changed their claims about privacy based on the discussion at Miguel de Icaza's post. Apparently they used to say that

Dropbox employees aren't able to access user files, and when troubleshooting an account they only have access to file metadata (filenames, file sizes, etc., not the file contents)

but now say

Dropbox employees are prohibited from viewing the content of files you store in your Dropbox account, and are only permitted to view file metadata (e.g., file names and locations).

Re:Encryption?

[Jonner]

I mostly store my data on my own machines. When I need to store private data on other peoples' machines, I encrypt it before uploading. Since Dropbox's client doesn't do that, it seems a poor choice when privacy is required.

Re:Encryption?

[Larryish]

ROT13 twice?

Re:Encryption?

[geekfarmer]

This link is the single best reason why I chose spideroak over dropbox: https://spideroak.com/engineering_matters#true_privacy To quote: "SpiderOak's encryption is comprehensive -- even with physical access to the storage servers, SpiderOak staff cannot know even the names of your files and folders." I was not looking for a convenient file-sharing service though. If you want file-sharing, Dropbox probably does that better. I was specifically looking for a cloud backup service I could use to sync both my linux server and my windows laptop. I wish their android app was more than just a file-access point, I'd love to put the txt messages and pictures on my phone in there too.

Re:Encryption?

[icebraining]

Not with an extra step:

encfs /home/$USER/Dropbox /home/$USER/encrypted_dropbox

Then put files on ~/encrypted_dropbox, and they'll be transparently encrypted before they're uploaded.

Re:Encryption?

[Xonea]

Well, no, it does not necessary.

Convergent encryption is a widely used technique, where a file is encrypted with it's hash value.
Thus identical files are always are encrypted with the identical key.

However yes - this breaks privacy for files which are saved by several users.

Re:Encryption?

[Jonner]

There are a number of ways to encrypt files before uploading them anywhere, including Dropbox. However, I'd rather use a service with a standard interface, unobfuscated interface, such as IMAP or HTTP, which allows more flexibility.

For example, one can use GMail Filesystem over FUSE with eCryptfs to mount a file system that stores everything encrypted in a Gmail (and probably any IMAP) account.

Alternatively, one can use duplicity to make and restore encrypted backups using a wide variety of protocols, including IMAP, scp/ssh, ftp, rsync, HSI, WebDAV, Tahoe-LAFS, and Amazon S3.

Re:Encryption?

[Vasheron]

Mod parent up!

Re:Encryption?

[LordLimecat]

I will go out on a limb and say that there are no free cloud-hosted file storage services where the hosting company does not have access to the private keys, at least in the stock default configuration (I know that CrashPlan, for example has an option where you can specify your own private key; but it is non-default and comes with a zillion warnings that you will no longer be able to do a "forgot my password").

Re:Encryption?

[Jonner]

Jungle Disk claims "The master key is based on a password YOU choose, known only to you and not stored with Jungle Disk." It doesn't say where the encrypted private key is stored, but at least they say they don't know the password used to encrypt the key.

Re:Encryption?

[Anonymous Coward]

Truecrypt volumes do work in Dropbox because it uses a block cipher(only changed blocks are synced, not the whole volume), ...

Either you forgot a part of that sentence, or you really need to read up on what a block cipher is and what a mode of operation is.

Re:Encryption?

[LordLimecat]

I may be wrong, but I do not believe they are telling the truth. Their logon page has a "forgot password" link, which would NOT be possible if they did not have the encryption key. If the key is not stored, and it is a hash of the password, it would be utterly impossible to recover any data without breaking the encryption algorithm or bruteforcing the password.

If you want to know if such claims are honest, just look for a trusty "forgot your password" link. If it allows you to choose a new password, then they are storing the key.

Re:Encryption?

[Jonner]

Yeah, I can't vouch for Jungle Disk since I haven't tried it myself. Reading some of their docs it sounds like there is the option of encrypting everything before sending it to them, though it wasn't entirely clear whether that was the default configuration and if so, for which of their services. When I do use any storage service for things I need to stay private, I'll always use my own tools to encrypt it before I upload anyway rather than trust the service's tool.

Re:Encryption?

[LordLimecat]

Encrypting things before you send it is an option with every provider, and some will indeed claim that as a "feature", when it is simply something inherent in any storage system.

As I said, all of these mass market free services will store the key, because otherwise the 50% of users (incl me) who forget their passwords would lose all of their files, and the first blogpost on such an occurrence would tank the company. As long as you understand the trade-off, and dont store super-sensitive stuff on there, its not an issue. And as they said, if you want to store super sensitive stuff, use truecrypt, or encrypted archives (zip, rar, etc), or keepass databases.

Re:Encryption?

[wastedlife]

I did not word it very well. What I meant was that Dropbox only synchronizes changed blocks of a file, instead copying the entire file every time there is a change. Since Truecrypt uses a block cipher (XTS is the mode of operation), Dropbox is able to synchronize changes to the Truecrypt volume very quickly.

See their; Drew's response on Hacker's News

[Anonymous Coward]

http://news.ycombinator.com/item?id=2483053

No kharma whore

Re:See their; Drew's response on Hacker's News

[jokermatt999]

I wish I had mod points. This really explains the story much better.

Don't understand

[Compaqt]

>import files into their accounts using hashes and bypassing the need to make files public.

???

It bypasses the need to make files public?

So, when you use Dropbox, you have to make files public? Isn't DropBox a way to share email attachments without attaching it to an email?

Why would you want to make it public?

Re:Don't understand

[VGPowerlord]

>import files into their accounts using hashes and bypassing the need to make files public.

???

It bypasses the need to make files public?

So, when you use Dropbox, you have to make files public? Isn't DropBox a way to share email attachments without attaching it to an email?

Why would you want to make it public?

My understanding is that you normally have to invite people one by one to see your non-public files.

However, it's apparently possible for people to just have the hash and add it to their own dropbox account using Dropship to gain access to it.

Re:Don't understand

[VGPowerlord]

To put it in DMCA terms (since this is eventually where it will end up), Dropship

is primarily designed or produced for the purpose of circumventing a technological measure that effectively controls access to a work protected under this title

-- U.S. Code, Title 17, Chapter 12, Section 1201(a)(2)(A)

...although I am not a lawyer.

Re:Don't understand

[HTH NE1]

Or generate random hashes and see what they get?

Re:Don't understand

[pmontra]

Basically that means that the secrecy of that hash is the only thing that protects our files on Dropbox. They probably encrypt the files but if anybody has the right hashes s/he can decrypt them. The hash is the key and invites and sharing are not even checked.

Re:Don't understand

[Compaqt]

Well, I'm not a lawyer, either, but, it's OK: see sig.

Anyway, isn't the copyrighted work the file that Dropbox users are sharing (or doing whatever with)?

How can Dropbox file a DMCA notice regarding a work that's not even their's?

Re:Don't understand

[kaiser423]

+1

This is one of the real issues. I get that hashes are unique, and how is someone going to get a hash of your file without the actual file? Well, it's tough, but it's not like it's being as seriously protected as a password or anything right now, so it might be an easy vector if someone can figure it out, but there's still bit to go before it's completely insecure.

Re:Don't understand

[thsths]

> The hash is the key and invites and sharing are not even checked.

Yes, so? Encryption works the same way, except that the key is the key. Once you give someone the key or the hash, you may leak your data.

Re:Don't understand

[xMrFishx]

That's like playing a DropBox one-armed-bandit

[ding][ding][ding] ... Porn
[ding][ding][ding] ... Porn
[ding][ding][ding] ... Movie
[ding][ding][ding] ... Porn
[ding][ding][ding] ... Illegal Porn
[ding][ding][ding] ... MegaCorp Design Files
[ding][ding][ding] ... Porn

Actually yeah someone make a script to poll the server, lets see what the casino of files gives us.

Re:Don't understand

[Anonymous Coward]

Why don't you try generating random hashes for a while and see what you find? I'll wait.

Re:Don't understand

[blueg3]

Fortunately, it's much, much harder to have accidental hash collisions, even with the weakest commonly-used hash algorithm, than anyone appreciates.

If a billion Dropbox users filled their 2 GB of free space with 1 kB files, these were all hashed with MD5, and you guessed a million hashes a second, it would take on the order of a trillion years to have a reasonable chance of guessing the hash of an existing file.

Re:Don't understand

[pmontra]

You're right about the key but I expected Dropbox to check if I shared the file with the people accessing it. It seems it doesn't so all the sharing thing is actually only a way to distribute the keys to the files. I naively thought it was part of the access policies in the same way Unix and Windows file systems do access control. If this were a Unix file system, we'd be able to access any file given the inode with no checks on the uid and gid. Basically we'd be working as root and that's a well known worst practice.

Re:Don't understand

[wlad]

Yeah that'd be funny. But they use 256 bit hashes.
Let's say all their 25 million users have 50GB of files hosted (an enormous exaggeration) that'd be 312500000000 4MB blocks.
That makes a 2.7e-66 chance of guessing a hash that matches (part of) an actual file. So you could keep guessing until the sun died without getting anything :P

Re:Don't understand

[xMrFishx]

Yeah, unfortunately you're right but I found it funny to write non the less. On the other hand, if only my botnet of PS3s were working, I could try more hashes at a time...[shakes fist] Damn You Sooonnnnyyyyyyyy!

Re:Don't understand

[codegen]

Since the person who purportedly owns the file has to give you the hash, this section does not apply.

Re:Don't understand

[Anonymous Coward]

Here is a security risk as far as I can tell.... This should be checked with someone more involved with the problem.

Pretend there is a large company 'BigOilCo'. Now suppose that everyday they set a price they will pay on a commodity (oil). The person who does the work uses dropbox to transfer the document to someone at head office, who embargoes it for publication until the next day. The (.txt) file always looks exactly the same, except the date is changed in the upper left, and the price is different. ( Pretend that the file comes from a financial mathematical modelling script). Then guessing the hash of the 'still secret' file is not a problem, just look at yesterdays file, change the date, and put in like 1000 different possible prices for oil tomorrow. Then you get 1000 hashes. Try downloading all those files from Dropbox. The one that downloads is tomorrows price.

A 2^256 hash table is huge, but the available space of small files that you already know almost all the details of can be very small.

I don't know how many sensitive files like this are floating around on Dropbox, but there are likely more than there should be!

DMCA or not

[AftanGustur]

It doesn't matter if they sent a DMCA or not, they clearly want a open source program off the internet.

Activate Streisant effect in 5, 4, 3, 2 ...

Re:DMCA or not

[Anonymous Coward]

Steisant effect?
is that when someone has a name similar to a famous person
and gets "Steisand'ed" by accident?

Re:DMCA or not

[ScentCone]

they clearly want a open source program off the internet

No. What they clearly want is to not have their reputation and business model tarnished by having their system turned into a big content piracy farm by people who are violating their very reasonable TOS.

Re:DMCA or not

[TooMuchToDo]

Too late. Genie = out of bottle.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Seems an odd response by DropBox

[sfranklin]

If I were running DropBox, I wouldn't go after the guys who exploited a weakness in the way my filesharing worked...I'd fix it. Seems very odd that DropBox would worry about DropShip at all. Now I don't know anything about how this stuff works and so it may not be a simple change, but if you're going to be a company that wants to provide secure filesharing, then you've got to make the change anyway, DropShip or no DropShip. So, update your code to close the loophole so it doesn't work any more. Problem solved, not only for DropShip but also for any other person looking at the same thing.

Re:Seems an odd response by DropBox

[PessimysticRaven]

If I were running DropBox, I wouldn't go after the guys who exploited a weakness in the way my filesharing worked...I'd fix it. Seems very odd that DropBox would worry about DropShip at all.

This is most likely the cynic in me speaking, but, I'm betting it might have something to do with the same issues most companies have with 'exploits' that are plays-on-words of the company/service name. Some dolt might mistake the two as a service from the same company. And while a company SHOULD praise the people that find exploits, no company likes the feeling that someone outside their payroll found an issue within their systems. Also, the folks who pay for a higher storage amount might suddenly go into tizzy about 'privacy,' get scared, and leave. Effectively losing revenue for Dropbox. I agree entirely with your question, though, especially with the bit I've quoted.

Hey, guys. Guys.

[Anonymous Coward]

http://www.horrendum.de/images/laanwj-dropship-464e1c4.tar.gz

Not a "DMCA Takedown," really

[Anonymous Coward]

Just to clarify, the email under discussion was not really a DMCA Takedown Notice, as we generally think of it. Those are notices sent by content owners to a service provider, demanding that certain content be removed. Those carry the legal restrictions and penalties for false filings. *This* was the notice sent by the service provider to the customer saying, "Oh, by the way, we had to take down XYZ because someone claims you can't do that." Which is completely different.

Now, the guys at Dropbox did contact others who were publishing Dropship. These were, by all accounts, very cordial messages, along the lines of, "We hope you understand that this isn't good for us. Could you please help us out?"

Streissand tag?

[erroneus]

I doubt I would have heard of this any time soon were it not for this advertising.

Re:Streissand tag?

[Chapter80]

Well, you might have heard about it if you read Hacker News or Reddit. :-)

I realize what you are saying, and yes, this is a perfect example of the Streisand effect. I am commenting more on how lagged Slashdot has gotten on current news. I read about this (and almost every other Slashdot front page story) on other sources many hours or days ago.

So what is the best drop-in file uploader?

[Marrow]

If someone wants to turn a apache webserver into a "ftp site" using the http protocol, what is the best drop-in solution. One that does not involve programming. I found one that has progress bar and stuff, but I am sure there are others out there.
What is the state of the art?

Last Straw

[Sensiblemonkey]

Slashdot has become increasingly misleading and sensationalist in recent years. So much so that I'm moving Slashdot's RSS feed to bottom of my pile; to be seen only in moments of extreme boredom. I have far better things to do with my time that wade through the constant stream of FUD that this site is generating these days.

Re:Last Straw

[iroll]

2003 called, they want their rant back.

Re:Last Straw

[ErikZ]

What sites are on the top of your RSS feed?

Re:Last Straw

[Requiem18th]

This isn't really sensationalist. Dropbox threatened them with false DMCA notices, that the notices were automated and accidentally sent doesn't meant they didn't do it.

I didn't know that law allows companies to "take back" crimes on accounts of accidents. "Sorry, my automated turret killed your son, it was an automated accident, there I said sorry, I owe you nothing".

If the authors of Dropship were a corporation they would sue for a settlement, but as individuals they don't have the legal muscle against a company and that's why they aren't suing, which is a shame but you'll likely just call it sensationalism anyway.

Oh and by the way, the authors of Dropship have not violated the TOS. Dropship USERS (may) did, and thus they don't even have a legal reason to ban these files, automated fraud notice or not.

I say "may" because I have not read the TOS, I don't how the TOS relates to the program, if the TOS ban using 3rd party tools that's one thing. If the TOS merely forbids making files not marked as public available to others then the connection to Dropship is even more indirect, meaning the responsible party is the one disseminating the hashes who isn't necessarily a Dropbox user in any case; likely so? VERY VERY likely, but not necessarily so.

"Sensiblemonkey" my ass.

Re:Last Straw

[Anonymous Coward]

Its still a great place to debate politics since there is a very diverse crowd, and slashdot has grown in user base for quite some time. I actually spend time here debating people so I am not bored at times. I suspect thats the reason its becoming the way you said. The more diverse a crowd and the more people that follow something, the higher the probability of people entering the fray who are willing to use sensationalist tactics to illicit a response and prove themselves right.

Censoring?

[ScentCone]

This isn't censoring. This isn't the government. That word is going to stop meaning something if people can't use it in some sort of rational context. Never mind that Dropbox is just trying to prevent their system from being turned into a big anonymous piracy farm - a very real concern, and one that they have every reason (and latitude within their TOS) to fight. But ... "censoring?" Why not just call them fascists, while we're at it? Idiots. This article it inaccurate, alarmist trolling.

Re:Censoring?

[LateArthurDent]

This isn't censoring. This isn't the government. That word is going to stop meaning something if people can't use it in some sort of rational context.

Do you know what the word means? Because I don't think you do.

Censorship, noun: the practice of examining for and suppressing unacceptable parts.

"Government" does not show up in the definition of the word. There is such a thing as "government censorship" in which case you must actually qualify "censorship" by preceding it with the word "government." You can even qualify it with the word self, as in "self-censorship," the practice of examining and suppressing your own unacceptable behavior.

Never mind that Dropbox is just trying to prevent their system from being turned into a big anonymous piracy farm - a very real concern, and one that they have every reason (and latitude within their TOS) to fight.

That's a fair argument to be made. I would most certainly agree they have the authority to block such a program for the reasons you've mentioned.

But ... "censoring?" Why not just call them fascists, while we're at it? Idiots.

Although they are within their rights to block the usage of the program in their servers, and ban any accounts which make use of it, they are not within their rights to prevent a program they do not own the copyrights to from being disseminated (which would be the 'censorship' part). That said:

This article it inaccurate, alarmist trolling.

The article is perfectly accurate and points out that dropbox's founder politely requested the removal of the program from the repositories, and the author voluntarily took it down. I don't see any wrongdoing on the part of dropbox (the DMCA request was a mistake they apologized for, as is also accurately noted in the article). The word censorship still applies: dropbox examined content and deemed it inappropriate, the author removed the content on request, thus applying self-censorship of his work.

Re:Censoring?

[ScentCone]

dropbox examined content and deemed it inappropriate

... but has no central authority, as a censor must in order actually censor things. The author didn't censor, he retracted, removed, etc., on his own volition. Censorship requires authority, and doesn't include choice.

Re:Censoring?

[LateArthurDent]

... but has no central authority, as a censor must in order actually censor things. The author didn't censor, he retracted, removed, etc., on his own volition. Censorship requires authority, and doesn't include choice.

Once again, you're including things which are not part of the definition for the word 'censorship'. Self-censorship is censorship and, by definition, it must include choice. Since dropbox were the people making the request for removal, they were certainly acting as censors, and the author provided them with the authority by complying.

None of this is bad, mind you. Your mistake is in assuming censorship is automatically a bad thing. It's only unequivocally bad when the censors have universal authority, which is why you dislike government censorship so much. In this case they don't, and others are hosting the project.

We're essentially on the same side of the issue, but arguing semantics here. I object to your complaint about the use of the word censorship, which is a perfectly valid term even when the authority of the censor is limited, although most certainly not worthy of the same disdain as censorship backed by higher authorities. Dropbox acted within their rights, and the article author pointed this out, even though he disagrees with their course of action.

Re:Censoring?

[ScentCone]

"self-censorship" is - except perhaps in psychological terms - a contradiction in terms, when you're talking about a single person. As you've no doubt noted in the dictionary, "self-censorship" refers to the actions of a group, which controls expression within that group. There is no choice as long as you want to be a member of that group and be subject to its authority over your actions as part of that group.

This isn't just semantics. The term "censorship" is wildly mis-used, all the time. It's important to get it right.

Re:Censoring?

[LateArthurDent]

"self-censorship" is - except perhaps in psychological terms - a contradiction in terms, when you're talking about a single person. As you've no doubt noted in the dictionary, "self-censorship" refers to the actions of a group, which controls expression within that group. There is no choice as long as you want to be a member of that group and be subject to its authority over your actions as part of that group.

Yes, I have read the dictionary definition to re-familiarize myself before starting a discussion like this. "There is no choice as long as you want to be a member of that group and be subject to its authority." I really want to start using [citation needed] tags. This is the definition I see. Self-censoring in order to avoid escalating a confrontation with the people who requested you take the content down (but have no authority to force you to take it down) certainly works as self-censorship. I'm not sure why this is a contradiction in terms in any way, shape, or form.

This isn't just semantics. The term "censorship" is wildly mis-used, all the time. It's important to get it right.

Now you're misusing the word "semantics"!. Semantics is defined as "the meaning of a word, phrase, sentence, or text". So, arguing the meaning of the word "censorship" is indeed just semantics, that's exactly what semantics is.

I do think it's important to get it right, which is why I'm arguing this point with you. However, you're the one getting it wrong. I've given you dictionary citations above in this post, can you point me to something that supports your argument?

Re:Censoring?

[ScentCone]

When we argue about semantics, we're arguing about how a word is used, and the meaning that it brings with its use. Debating whether or not censorship includes deciding (personally) not to say something (or to un-say something) absolutely is semantics. But when people say "just semantics," they're being dismissive about the differences between word choices or about the appropriateness of a word's use.

As for the definition you've cited, you're ignoring the only part that makes it meaninful: "to avoid castigation" - meaning, the phrase, as used, is meaningful only in the sense that one values continued participation in whatever group you fear will castigate you. If you want to hang out with Mac fanboys, you self-apply the group's censorship rules about praising Bill Gates. The group has the censorship rule (or has established the expectation of the penality of castigation) and the only "self" part about it is the personal decision to continue to share the group's values/rules. Don't like a university's censorship of some sort of religious wacko speech made by roving wannabe prophets on doorsteps of every fraternity and dorm? Leave the school. Don't like Castro's censorship of your speech praising free enterprise? Leave Cuba. Oops, can't do that! Now we're talking real censorship, in the way that it really matters ... and in the way that whiny people frequently invoke the word while shrilly complaining about something that makes them mad, but which really isn't censorship at all.

From the Collins 10th Unabridged World English Dictionairy, on the phrase "self-censorship:"

the regulation of a group's actions and statements by its own members rather than an external agency

The term is used in reference to the individual only in a more poetic way, to paint the image of two layers of one's mind fighting over whether or not to say something, and weighing the consequences of doing so (as in, one having no choice but to bite one's tongue, because the phrase that's being checked is simply an ill-advised thing to say ... you, yourself, aren't going to send you to jail or kick you out of your club of one if you say it anyway).

Re:Censoring?

[LateArthurDent]

When we argue about semantics, we're arguing about how a word is used, and the meaning that it brings with its use. Debating whether or not censorship includes deciding (personally) not to say something (or to un-say something) absolutely is semantics. But when people say "just semantics," they're being dismissive about the differences between word choices or about the appropriateness of a word's use.

When people say "just semantics", they mean that they agree on the issue at hand, but disagree on the description. As in, we both agree Dropbox did nothing wrong, but we disagree on whether or not to call it censorship. This is, "just semantics."

As for the definition you've cited, you're ignoring the only part that makes it meaninful: "to avoid castigation" - meaning, the phrase, as used, is meaningful only in the sense that one values continued participation in whatever group you fear will castigate you.

No I didn't. First of all, that part of the definition said, "especially to avoid castigation" as in, not a necessary condition. Another definition on that page mentioned "out of deference for the sensibilities of others." Second, I specifically said, "Self-censoring in order to avoid escalating a confrontation with the people who requested you take the content down" even though this fear is not a necessary condition for it to be called censorship.

If you want to hang out with Mac fanboys, you self-apply the group's censorship rules about praising Bill Gates. The group has the censorship rule (or has established the expectation of the penality of castigation) and the only "self" part about it is the personal decision to continue to share the group's values/rules. Don't like a university's censorship of some sort of religious wacko speech made by roving wannabe prophets on doorsteps of every fraternity and dorm? Leave the school. Don't like Castro's censorship of your speech praising free enterprise? Leave Cuba. Oops, can't do that! Now we're talking real censorship, in the way that it really matters ... and in the way that whiny people frequently invoke the word while shrilly complaining about something that makes them mad, but which really isn't censorship at all.

You cited your first two as examples of censorship, then you cited the third as example of "real" censorship. No, they're ALL real censorship, except the third one has a greater authority backing it, making it a larger problem. Once again we agree on that, but you refuse to use the word correctly because you want "censorship" to mean "censorship of the type people can't escape from, which I especially don't like." The word censorship means the removal of content deemed objectionable. That's all that the word means. Any additional meaning to the word that you bestow it is not part of the actual definition, and is incorrect. It mean censorship exists within a range, some of which you do not object to, and some of which you find oppressive. You have no standing to demand that other people use words by the definition that you want to use simply because you don't agree with the actual definition.

From the Collins 10th Unabridged World English Dictionairy, on the phrase "self-censorship:"

the regulation of a group's actions and statements by its own members rather than an external agency

I wonder if you understand that definition. You do understand that in this example, the external agency is Dropbox, and the 'group' are the set of people who received requests to take the source code down, right?

The term is used in reference to the individual only in a more poetic way

[citation needed

to paint the image of two layers of one's mind fighting over whether or not to say something, and weighing the consequences of doing so (as in, one having no choice but to bite one's tongue, because the phrase

Re:Censoring?

[Anonymous Coward]

...and one that they have every reason (and latitude within their TOS) to fight...

They may have a motivation to fight, but they don't have a right to fight in certain ways, and that includes sending out bogus DMCA notices. And as soon as they invoke the DMCA, the takedown is a legal matter, enforced by the government - hence, censorship.

FTFA, both sides seem guilty. I'm confused.

[bl8n8r]

Dropship that allows users to exploit Dropboxâ(TM)s file hashing scheme to copy files into their account without actually having them."

I can see why they would be a bit ruffled over this. Seems like this could be in the same realm as an SQL injection attempt. It's just using JSON instead.

"First of all, attempting to protect a proprietary protocol is going to get them nowhere. "

Ok, that's a problem. The reason the protocol is proprietary is because the company has put a lot of time, money and effort into developing their product. They want to recoup some of the development costs through the implementation of their protocol.

The DMCA thing well ...that's what the DMCA is. It's basically a catch-all b1tchstick that can be bent into whatever shape the law wants to blame whoever for whatever. The way dropbox handled things *is* pretty crappy IMO, but if you're going to be a dick and crack peoples websites.... expect to get dick'd back.

Re:FTFA, both sides seem guilty. I'm confused.

[metacell]

Seems like this could be in the same realm as an SQL injection attempt. It's just using JSON instead.

The hack only allows people to share their own files with others more easily. It's not like it would allow them to take over the web server or access other people's files without permission.

I don't see how this could compete with BitTorrent - everything a pirate uploads onto Dropbox is logged and can easily be used against them in a trial.

Bullshit

[wlad]

Hi, I'm the person why wrote dropship. This thread is completely bogus, as there were no DMCA requests issued at all. They mailed me and asked me nicely to take the code down from github, which I did.

The DMCA confusion is because they stopped a file from being shared on their own service, which generated a silly mail that a DMCA request had been received from themselves and hence a file was taken down. The blogger confused this with a DMCA request (and corrected it afterwards, but it seems slashdot missed this).

So can we cut it with the flamebait title?

DMCA may be the strongest 4 letter word!

[Maintenance Goof]

Does this mean that DMCA is an actually restricted four letter word? That would make DMCA the strongest cuss word of them all! What ever you do, don't threaten to DMCA someone, especially in writing, unless you have what it takes to DMCA someone! That's just DMCA'd up.

Re:FTFA, both sides seem guilty. I'm confused.

[wlad]

It's not even *remotely* like an exploit or SQL injection attempt. It reproduces exactly what the original client does through HTTPS. Except that it skips the initial hashing part. But it's certainly not a server exploit like you pretend.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:Hey, guys. Guys.

[grub]

Thanks, Barbra!

Re:FTFA, both sides seem guilty. I'm confused.

[bl8n8r]

Hmm.. the author calls it an exploit in the article. Seems to me that anytime you devise a method to utilize something that it wasn't really intended for is indeed and exploit, hack, workaround, kludge, whatever.

I think it's marvelous this person found a way to use the system in a way it wasn't intended. He/She is probably very bright. Thing is though, if you're going to mess around in places you really aren't supposed to, don't be surprised if someone takes issue with it. That's the risk you take. Used to be people used pseudonyms to mitigate some of the risk, but that's a whole 'nother discussion on privacy vs. idiocy.

This is a massive security hole.

[Jason Pollock]

If someone can grab access to files by uploading a hash without worrying about sharing, that means they can generate random hashes and gain access to files. ouch.

Re:This is a massive security hole.

[shutdown -p now]

So far as I could tell, the hash in question is 256-bit - so that's 2^256 possibilities. Good luck generating a random one that happens to match that of some real file.

It's a shame SpiderOak's sync funtion doesn't work

[Overzeetop]

Never has, never will based on the replies from CS/Tech Support. Seems that it will work okay with a simple setup and small data set, but get one thing off or try to use what you paid for (in my case, about 100GB of corporate data), and you can just give up. I spend two months, five re-installs, and countless hours trying to get things to work - we finally just gave up and went with an inferior service that we could make work acceptably.

FWIW - SO's backup service was flawless. I never found a missing file or had a problem with it keeping the backup data working.

Re:It's a shame SpiderOak's sync funtion doesn't w

[Anonymous Coward]

Thanks for your feedback. It's quite right that it took us a long time to get zero-knowledge Sync working perfectly with all the amazing edge cases. I'd say the newer versions of SpiderOak are probably 98% there now (just gauging from how many customers are very happy with it) and in the next release or two we'll be golden.

The challenges are different than a traditional sync algorithm, because there's not a server which sees everything and can direct the traffic. Every calculation has to happen client side. Thanks for giving us a try regardless. :)

Re:It's a shame SpiderOak's sync funtion doesn't w

[Anonymous Coward]

>I never found a missing file
Wait, is that a good thing or a bad thing? I'm confused.

It's easy to ask others to stand on principle

[DragonHawk]

"According to some, 90% of all email is spam. Does that make SMTP an illegitimate protocol? Often, the easiest way to find copyright infringing works is using Google. Does that make the search engine illegitimate? Porn drove early VCR development. Is VHS an illegitimate technology?"

There's a difference between a protocol specification and actually wanting to foot the bill for the infrastructure and legal battles. You want to defend file sharing? Fine, buy a hosting account and go for it. Don't expect DropBox to foot the bill, though.

Re:It's easy to ask others to stand on principle

[Jonner]

I do not support violating Dropbox's terms of service and have no interest in using them anyway. I was only responding to the idea that anonymous file sharing is only useful for illegal purposes and is not a legitimate topic for a story.

FUCKING SLASHDOT EDITORS STOP POSTING SENSATIONALI

[xtracto]

FUCKING SLASHDOT EDITORS STOP POSTING SENSATIONALIST BULLSHIT.

There, I said it. There are in fact news worthy for slashdot readers within all this mess:

1. That Dropbox uses a transfer mechanism which is pretty much "security through obscurity".

2. (Most important) that you can potentially get any file by only having their hashes. I think this is a huge security problem waiting to be exploited. What prevents someone to "brute force" a JSON file to download scan and download any available files? I am sure with a bit more of thinking, that would be interesting.

Too bad it was nobody else than Mr. Malda who posted this... it really shows that he is more interested in posting sensationalist crap, instead of real and interesting NEWS FOR NERDS and STUFF THAT MATTERS.

Quick someone, make a slashdot clone (I'll try again hackernews).

Dropbox referral

[Anonymous Coward]

If you want 250 Mb extra when joining Dropbox you can use this link:
http://www.dropbox.com/referrals/NTM1MDM5MTE5

DMCA? Don't host in the USA!

[Anonymous Coward]

Why host your files in a country that is hostile to creativity and RW culture? Sure, you may still live there, but that doesn't mean that your files have to.
Yes, they may be able to sue you but the entity who hosts the files doesn't have any obligation to respond to DMCA takedown notices.

Use git-annex

[RichiH]

git-annex uses git to track your metadata and rsync to move your files around. It knows which repos hold what files and can enforce minimum copies, trust levels, etc.

Also, it can store transparently encrypted data with untrusted third parties like Amazon S3. You can even have it use bup as a back-end which gives you change tracking of actual data, not only metadata. Oh, and a FUSE front-end is in the works which means you get 100% transparent file tracking, distribution and backup. All based on FLOSS and you are in control.

If you know how awesome VCS are and want to use them to actually get some order into your files, configs and maybe even life, click the links below.

http://git-annex.branchable.com/
https://github.com/apenwarr/bup
http://lists.madduck.net/listinfo/vcs-home
#vcs-home on irc.oftc.net

Fair enough

[DragonHawk]

Fair enough. I wasn't clear on that.

Re:Bullshit and Dropbox

[lsatenstein]

Dropbox is a system to store and share files on your desktop, with other partners. It is their design, and their business model. They provide 2 gigs of free space, which is great and appreciated. To circumvent their business model, and actually usurp the ability for them to run a business is wrong. This is analogous to MacDonalds providing sodapop with your meal using a open dispenser, and you go ahead, borrow a cup, and refill your cup a couple of dozen times.

Thats the way I see it.

Re:Bullshit and Dropbox

[wlad]

I think you misunderstand. The tool never allowed to store more than your quota worth of files. The files "teleported" into your account still counted as normal files. They also have to be in someone elses folder at the moment that dropship is used. Their problem with it that it would make illegal file sharing easier, and they didn't want to run the risk to be associated with that. It's simple as that.

Re:Bullshit and Dropbox

[Anonymous Coward]

Thank you for the clarification. I would not use Dropbox for illegal file sharing. I was always honest and only took music from my kids. They told me that they got the music legally, but did not tell me more. I have not seen CDs with stereo versions of classical music, only older monaural recorded CDs.

Here is an actual, real security risk from it.

[Anonymous Coward]

Thanks for clearing that up.
Here is a security risk as far as I can tell....

Pretend there is a large company 'BigOilCo'. Now suppose that everyday they set a price on a commodity. The person who does the work uses dropbox to transfer the document to someone at head office, who embargoes it for publication until the next day. The (.txt) file always looks exactly the same, except the date is changed in the upper left, and the price is different. ( Pretend that the file comes from a financial mathematical modelling script). Then guessing the hash of the 'still secret' file is not a problem, just look at yesterdays file, change the date, and put in like 1000 different possible prices for oil tomorrow. Then you get 1000 hashes. Try downloading all those files from Dropbox. The one that downloads is tomorrows price.

A 2^256 hash table is huge, but the available space of small files that you already know almost all the details of can be very small.

I don't know how many sensitive files like this are floating around on Dropbox, but there are likely more than there should be!

Re:Here is an actual, real security risk from it.

[metacell]

Someone pls mod parent Informative or Insightful. It's one of the few posts that actually has anything useful to say about this article...

Re:It's a shame SpiderOak's sync funtion doesn't w

[Unequivocal]

I have had repeated problems with their sync also - though it does work 99% of the time for me as a very small user (2gb free account). Great to know that their sync stuff doesn't work for large/complex deployments.

Ditto their backup solution -- it works great and has never lost anything for me.

Fake DMCA request -- Criminal/ Civil

[Anonymous Coward]

Exactly how illegal is this? My guess is "very."

IMO, it need not be criminal if a false statement causes harm $$. Civil action
might cause more effective action than limp noodle legal actions by a civil servant that
in a department of Justice some place with a murder to persecute/prosecute.

It is not clear to me that Xfast.con has the legal right to provide a pay
per view service. What if I was to launch a DMCA against that company?
As per the DMCA the ISP must act even if the ISP is also the service
company..... And if the material was in fact copyright and illegal the ISP
would loose for not acting. Durned if they do durned if they don't.

TFA's DMCA response seems wrong

[SpammersAreScum]

Ok, so there's some confusion as to whether there really was a DMCA notice, and whether such notice was (would have been?) valid. Quite aside from that, I am puzzled about the notice response quoted in TFA. Basically, the responder says the material is non-infringing because it has a copyright notice allowing copying/modification/etc. But the existence of such a notice does not in any way guarantee that someone else does not have a legitimate claim of infringement, right? Which is not to say that DropBox has one, just that this does not seem to be a valid argument that they don't.