About Dropbox

I’ve been meaning to write a post about the many people complaining about Dropbox’s security for awhile.  The complaint basically boils down to: “If they can access your computer, they can access your Dropbox account”, which can actually be shortened to just “If they can access your computer, bad things”, which is where the real problem is, which has nothing to do with Dropbox.  Would it be nice if Dropbox didn’t store encryption keys as a special mode you can turn on?  Of course it would.  But if someone has physical access they could just install a keylogger to get that key, blah blah blah… security through obscurity.

Then Michael de Icaza, one of the best hackers anywhere and somebody I greatly respect, wrote a very reasoned post about how Dropbox’s privacy and security pages don’t make it absolutely crystal clear that Dropbox employees can access your files, which is a very fair, if perhaps minor, criticism.  If I really want to be careful about my files, of course, I’ll use Truecrypt or whatever instead of trusting a closed-source binary file syncing client.  But the amount of information that I’m that interested in protecting at that level is really small, so meh.

Then the shit hit the fan.  Some guy wrote an app that could potentially (gasp, potentially!) be used for piracy.  Of course we can’t have this.  Apparently unfamiliar with the Streisand effect, Dropbox tried to get it pulled, from, among other places, HN.  Good luck with that.  They stopped hosting the content and inadvertently (and illegally) sent a DMCA takedown notice (note to self, never write code that sends DMCA takedowns).

So I know the Dropbox guys, and I know they’re bright, and nice, and ethical.  I’ve even been recruited to work there (hi, guys!)  But this was the wrong thing to do.  Not a little bit wrong.  Not kind-of wrong.  Very wrong.  And instead of fixing it, they defended it:

i hope you guys can give us the benefit of the doubt: when something pops up that encourages people to turn dropbox into the next rapidshare or equivalent (the title on HN was suggesting it could be the successor to torrents), you can imagine how that could ruin the service for everyone — illegal file sharing has never been permitted and we take great pains to keep it off of dropbox. the internet graveyard is filled with services that didn’t take this approach. – Drew Houston, CEO

I share in the neighborhood of 80GB of  unencrypted data with Dropbox, which is much more than I share with any other person or entity.  And I pay them $200/year for this, and I’m more than happy to do it.  But I was definitely under the impression that they were a neutral hosting service–that is, whatever I store or host on their platform as a paying customer is between me and the laws of the United States Government, not subject to Drew Houston’s editorial control.  You know, like a hard disk, or a normal hosting provider. Apparently I was mistaken.

I’m not saying that there’s not room in the market for a more curated sync service, that Dropbox is not within its rights to do what it did, that what they did doesn’t make in fact a lot of sense in today’s political climate, or that they may ultimately feel that their hands are tied with the current legal landscape.  I mean, of all the things that they could refuse to host, it’s of such small importance that it’s almost insignificant.  That’s not the point.  The point is that I thought I was paying for a hard disk in the cloud that I could store 1s and 0s on, for all legal sets of 1s and 0s. But it turns out that I can only store the 1s and 0s that the Dropbox team likes, which is a provably proper subset.  I thought I was paying for A, but it turns out I’m in fact paying for B.  That’s the problem.

Out of the woodwork come the people who hate on cloud storage in general, and say “this is why you should never host data in the cloud”.  I mean, I’m very conscious about how I use, say, Google Docs, because I know that Google has pressure from US and foreign governments and so on, and I’ve made a very conscious choice to limit (not eliminate) use of those services in proportion to the sensitivity of the information that I’m working with.  I mean, I don’t store source code in Google Docs, or S3.  Up until today, I’ve been very liberal with my use of Dropbox since I’ve really trusted the team.  I’ve always been preparing to re-evaluate that situation when they get the inevitable acquisition from some BigCorp, but I didn’t expect to be faced with that problem until then.

Well, today, I’m no longer comfortable with the status quo.  Assuming that this remains their official position on the matter (HN comment is from the CEO–there’s no reason to think they’ll reverse course on this and my $200 isn’t really worth much in the scheme of things), I’m officially looking to sign up with a competitor.  There are some OSS things I want to play with, and potentially contribute patches to.  I have a lot on my plate this month, so I may not switch over 100% today, or in the immediate future, but it’s going to happen, even if I have to write the damn thing myself.  The technical vision for a file syncing service is way too important to leave to one team, even a team as nice and as cheerful and as reasonable-sounding as those guys.  I don’t actually anticipate creating a commercially-viable competitor–all I want to do is put a hard disk in a datacloset and sync with it.  And if that means I have to actually put some hard disks in a datacloset, well, that’s what I’m going to do.

---

Want me to build your app / consult for your company / speak at your event? Good news! I'm an iOS developer for hire.

Like this post? Contribute to the coffee fund so I can write more like it.