Slashdot Mirror
Dropbox Attempts To Kill Open Source Project
Meskarune writes "Dropbox is trying to kill the Dropship project, a useful program that allows users to import files into their accounts using hashes and bypassing the need to make files public. Dropbox sent out fake DMCA requests to all parties involved, and is banning and censoring the program."
Wouldn't an attempt to intentionally mislead someone with regard to DMCA be regarded as fraud?
Okay, according to the update at the bottom of the link (I know, I RTFA, weird, eh?),
Update: I want clear up a few things. As far as I’m aware all of the Dropship repositories and archives that were taken down was done so voluntarily. Dropbox never made threats, legal or otherwise. It appears the DMCA notice was automatically sent to me when the file was banned from public sharing. There was no real DMCA takedown issued. It was an edge case bug in their file removal system.
Apparently, Dropbox is asking nicely, but when they flagged the file it triggered an accidental DMCA notice, for which they seem to be apologizing.
Useful though it may be, it's very clearly against Dropbox's Terms of Service. That doesn't give them the right to issue takedown notices to other sites on copyright grounds, but let's separate, "evil for issuing fake takedown notices" (which they are), from "evil for wanting to prevent this kind of activity" (which is perfectly reasonable).
They're not running a filesharing service, that's not their business model, and they don't want to end up like Rapidshare or any of the N other filesharing services in legal hot water. I love Dropbox, and I would hate to see one of it's most useful features- public collaboration folders- shut down because some asshats can't obey the TOS and just use torrents instead. Dropbox should be trying to find a technical solution to block something like this, but if that's not possible, what can they do?
Dislike the Electoral College? Lobby your state to join the National Popular Vote Interstate Compact.
Vote this article down - it's misleading flamebait in the extreme. In particular, it fails to mention that the software was designed to facilitate anonymous filesharing, which would most certainly be used for copyright infringement and illegal purposes. And, the whole thing goes against Dropbox's TOS, even if it isn't used for dubious file sharing purposes.
I'm with dropbox on this one. The idea of converting dropbox into some sort of filesharing/torrent service, for passing potentially illegal files around is not good.
I can see why Dropbox doesn't want to be linked to such a thing, when the big media people come a knocking, who do you think is going to end up getting sued?
And just because its open source doesn't make it right, or wrong, or change anything.
I mean, from the FA, it talks about how Dropship is exploiting the Dropbox hashing algorithm, which might be copyrighted along with the rest of Dropbox (I don't know). If it was, then I could see why there would be grounds for copyright infringement, unless the OSS project could demonstrate that it arrived at that dropbox hashing algorithm through blackbox testing.
Thankfully, copyright does not apply to algorithms and the US has a legal system based on the idea that people are innocent until proven guilty.
If they used real encryption they would have to host files over and over again. Encryption breaks file deduping. No way is dropbox going to do something like that, there is no advantage in it for them.
Sending a fake DMCA takedown is illegal, yes, but an e-mail that says "we deleted your file due to DMCA takedown notice we received" isn't a DMCA takedown notice. And apparently that e-mail just went out automatically any time they banned a file from someone's account. Apparently it never occurred to whoever designed their system that a file might be removed for anything other than copyright violation... or maybe the admin just didn't select the correct reason when he banned it.
>import files into their accounts using hashes and bypassing the need to make files public.
???
It bypasses the need to make files public?
So, when you use Dropbox, you have to make files public? Isn't DropBox a way to share email attachments without attaching it to an email?
Why would you want to make it public?
My understanding is that you normally have to invite people one by one to see your non-public files.
However, it's apparently possible for people to just have the hash and add it to their own dropbox account using Dropship to gain access to it.
GLaDOS for President 2016! "Well here we are again. It's always such a pleasure." -- GLaDOS, 2011
It's already been shown that Dropbox's claims about security are mostly bogus. If Dropbox can Hand Over Your Files to the Feds If Asked then the encryption method they use to store files on their servers is meaningless since they have the private keys anyway.
To put it in DMCA terms (since this is eventually where it will end up), Dropship
is primarily designed or produced for the purpose of circumventing a technological measure that effectively controls access to a work protected under this title
-- U.S. Code, Title 17, Chapter 12, Section 1201(a)(2)(A)
GLaDOS for President 2016! "Well here we are again. It's always such a pleasure." -- GLaDOS, 2011
Or generate random hashes and see what they get?
Oh, say does that Star-Spangled Banner entwine / The myrtle of Venus with Bacchus's vine?
According to an anonymous comment on the blog:
IOW: If you can get ISPs to be your puppets to send "kind" emails to their users, nobody is at fault regardless of the damages done by the emails.
DMCA: Best draconian law you can buy!
Obama's legacy: (N)othing (S)ecure (A)nywhere and (T)error (S)imulation (A)dministration
Slashdot has become increasingly misleading and sensationalist in recent years. So much so that I'm moving Slashdot's RSS feed to bottom of my pile; to be seen only in moments of extreme boredom. I have far better things to do with my time that wade through the constant stream of FUD that this site is generating these days.
This isn't censoring. This isn't the government. That word is going to stop meaning something if people can't use it in some sort of rational context. Never mind that Dropbox is just trying to prevent their system from being turned into a big anonymous piracy farm - a very real concern, and one that they have every reason (and latitude within their TOS) to fight. But ... "censoring?" Why not just call them fascists, while we're at it? Idiots. This article it inaccurate, alarmist trolling.
Don't disappoint your bird dog. Go to the range.
Basically that means that the secrecy of that hash is the only thing that protects our files on Dropbox. They probably encrypt the files but if anybody has the right hashes s/he can decrypt them. The hash is the key and invites and sharing are not even checked.
they clearly want a open source program off the internet
No. What they clearly want is to not have their reputation and business model tarnished by having their system turned into a big content piracy farm by people who are violating their very reasonable TOS.
Don't disappoint your bird dog. Go to the range.
Hi, I'm the person why wrote dropship. This thread is completely bogus, as there were no DMCA requests issued at all. They mailed me and asked me nicely to take the code down from github, which I did.
The DMCA confusion is because they stopped a file from being shared on their own service, which generated a silly mail that a DMCA request had been received from themselves and hence a file was taken down. The blogger confused this with a DMCA request (and corrected it afterwards, but it seems slashdot missed this).
So can we cut it with the flamebait title?
Yeah, unfortunately you're right but I found it funny to write non the less. On the other hand, if only my botnet of PS3s were working, I could try more hashes at a time...[shakes fist] Damn You Sooonnnnyyyyyyyy!
Encrypting after dedupe breaks the whole point of encryption. It means every copy of the same file is encrypted the same way. That means I can tell who has what files. At that point you are encrypting only to claim you do it.
Never has, never will based on the replies from CS/Tech Support. Seems that it will work okay with a simple setup and small data set, but get one thing off or try to use what you paid for (in my case, about 100GB of corporate data), and you can just give up. I spend two months, five re-installs, and countless hours trying to get things to work - we finally just gave up and went with an inferior service that we could make work acceptably.
FWIW - SO's backup service was flawless. I never found a missing file or had a problem with it keeping the backup data working.
Is it just my observation, or are there way too many stupid people in the world?
Jungle Disk claims "The master key is based on a password YOU choose, known only to you and not stored with Jungle Disk." It doesn't say where the encrypted private key is stored, but at least they say they don't know the password used to encrypt the key.