skysight-inc/HackerNews huggingface dataset:
This would completely defeat the point of Dropbox, then; If your Word document is in your Word folder, how does it get to another computer? Do you give the app developer, Microsoft, exclusive right to 'sync' your files elsewhere?

Sandboxing is a good idea. An old idea, actually; chroot was added to unix in 1979. But shared filesystems evolved and are the norm, and even if many apps could be sandboxed, Dropbox exists outside the sandbox for a reason.
Process Monitor[1] will show you every filesystem call Dropbox is making. (Like strace.) That should confirm or refute this article's claims.

(You could also just collect an ETW trace and analyze it in xperf (err, WPA, of course) yourself.)

[1] https://technet.microsoft.com/en-us/library/bb896645.aspx
While I tend to agree with you, there are exceptions.

Based on history, NASA is a prime example. A government-run organization with a solid track record of contribution to humanity as a whole, not to mention accomplishing feats previously thought impossible.
Zombie outbreak? Statistical mechanics reveal the ideal hideout
"Access" is a bit vague. It's one thing if their 'fstat' is leaking, it's another thing if they are actually reading all the bytes of those files.

Another piece of evidence I'd like to see is a mitmproxy checking out what's under that TLS session. Improper local reads are one thing, it's another thing entirely if they are communicating back file names, hashes and/or the file data actual.
It's 4.5M excluding all downloads from China. There were probably a lot of legitimate downloads from China but given the impressive number of downloads from bots there we had to exclude all of them in the total.
We have created this application with the intention of people having fun with it.
But, it can be used for serious stuff like sending feedback anonymously.
I doubt you know what you're talking about.
It's a feedback loop. The price wars made manufacturers cut every corner they could and now we have frail products. It's also a byproduct of fast evolving times. We want to try the new shiny, so every year, drop the older to buy the latest which is convenient for brands to roll production (the only part the mob talks about sadly).
Trying out the new Vulkan graphics API on PowerVR GPUs
TBF if API developers get confused with a newish HTTP method, they're not very resilient. Said HTTP middleware can be adjusted easily, the methods are simple enough usually.
Calling All Samba Users: 2015 User Survey
The article draws a pretty solid argument, if you wanted to confirm results yourself I'd suggest creating a windows vm, installing dropbox, and getting a packet capture of the traffic leaving when you drop a .docx file in the C:// directory.

It's not a stretch of the imagination that dropbox could still be making a profit spending bandwidth and storage space this way. I can think of a government agency or two that would re-imburse the costs.
In a while, this will be disregarded as a bug, might be fixed and maybe Dropbox will even state that they apology and will be deleting all mistakenly uploaded files from their server(s).

But you don't know. The lesson to be learned here is that proprietary software cannot be trusted.

https://www.gnu.org/philosophy/can-you-trust.en.html
As you see below, Dropbox says that "only checked folders will sync to this computer"

Very interesting wording. I don't want to play conspiracy theory, but it only says what will sync to the computer. It doesn't say anything about what will sync (or upload) to the cloud.
Just found that : http://i.imgur.com/rTt5qiP.jpg

'Without deviation from the norm, progress is not possible.'

https://www.youtube.com/watch?v=DjMO_ewZxIQ
I've just run a quick strace on Linux but I don't see it accessing anything outside by ~/Dropbox folder.
OCaml can compile to native. That makes it faster than F# running in a VM. OCaml can compile to bytecode as well. Also, if you ever need interfacing with C/CPP, OCaml is better suited (faster) to the task than, say, Ruby or JVM based languages.

Apart from that, multithreading in OCaml is a bit like on its on Python, IIRC, with GIL taking the sting out of it. But I am sure the researchers in France and elsewhere would bring true multithreading / multicore support to OCaml sooner rather than later.

More on what OCaml gets right: https://realworldocaml.org/ (which seems to be down right now).
I think it's a matter of design. The Smalltalk integrated environment feels completely right and was designed wonderfully with that intent in mind.

The JVM, likewise, has had a consistent and clear scope throughout.

Browsers are still not fully scoped out. From year to year, it varies what webapps can do and what the norm is. Furthermore, it was not originally designed with this usecase in mind. All those contribute to it feeling a lot more awkward for this purpose than other, better designed, solutions.

Also, JVM/Pharo have significantly smaller scopes which helps.
What I meant is the app/service isolation on the OS level. It should not apply just to a subset of apps, but to each and every process that runs on a device.
Don't build Brasilia. That is all.
"Absurdly low cost" won't work with the giant welfare system that is the DoD.
You don't compare in the same dimension. Newer washing machine might be more water and energy efficient than a 20-year-old one. But why do you think this affects its durability? Are you arguing that Samsung can't build efficient washing machines that are also durable?
It is not much different from a prepared statement or a stored query, indeed it can even be parameterized. With keepalive two requests is not so bad.
Algae, or Green/blue Algae, more specifically.
Remote attestation poses a problem when working with proprietary network services. But you already have a problem in that case, the network service.

But when done sensibly and used in a system that's under the user's control (incl. that remote service), it's a security enhancing feature.

And people might not be as much in arms about it anymore because the landscape changed: The original Palladium proposal was made in an environment where the only threat model was "consumers 'steal' content".

Today, measured boot is also a legitimate security measure against criminal activity targetted at the user (eg boot kits, extortion ware), which didn't really enter the picture back then.
> Of course, then we just give all those permissions back to any apps that ask for them.

At least in the case of Android, there is no permission that will give you access to the root filesystem or other apps' sandboxes. Categorically not allowed.

App data is restricted to /data/data/$PACKAGE_NAME. The rest of internal storage is either read-only or completely off-limits (especially in the case of other apps' data). The only way to access data that belongs to other apps is to share the same developer signing key, or explicitly share the data using a content provider.

The only exception is external storage (the SD card, if present). But that's because SD cards use FAT and therefore can't support per-application permissions.
The context is choosing folders for Selective Sync, versus synchronizing the entire Dropbox folder. This is not their TOS or something.
So, if someone finds a vulnerability in Docker software and roots a process, your filesystem is safe?

The idea is not sandboxing, it's "multiverse". Each process, even an OS one, gets its own little filesystem, and connects to a limited set of interfaces explicitly permitted by the user (and that can be audited by the user).
Cool you are right. I really love the point about researching. Apart from the things mentioned by you writing blog helps a person to know how to derive engagement. As I can see digital marketing is going to play an important role in lead generation for your startup and hence blogging is best way for your teams to acquire the skills.
Independent measurements but not necessarily independent assumptions, and hence interpretations of those results.
Location: Vienna / Austria

Remote: yes

Willing to relocate: no

Technologies: Main stack: PHP (symfony), Javascript, CSS (Sass), MySQL, MongoDB, Vagrant, ansible, git; Other technology I played with: Python, nodejs, Haskell, bash, Go, Rust, Ruby, ElasticSearch; Platforms: Amazon AWS, DigitalOcean, Codeship, github, bitbucket, CloudFlare, BrowserStack, MailChimp

Résumé/CV: https://www.xing.com/profile/Sebastian_Goettschkes

Weekend project: https://cllctr.net | https://github.com/agileaddicts/cllctr

Email: sebastian dot goettschkes at googlemail dot com

I like to build stuff. I like to learn stuff. I like to deliver value.
There are 3 key elements to any consulting:

1) Tell the client what you're going to do
2) Do it
3) Tell them you've done it

Even on-site consultants can make the mistake of failing to communicate at the various steps (Sales, Delivery, Service) along the way. While it's harder to do remotely (no water cooler talk) you also have the advantage of knowing this from the start and therefore scheduling / managing from the get-go.

You may need some tax advice, and IANAA but pricing and invoicing can be fairly straightforward. When I've done it, I've usually quoted in the client's currency but invoiced in mine at the appropriate exchange rate. This can cause some ups and downs for your margin, but I'll take 95% of something over 100% of nothing. Good luck!
Do you really think that what is being advocated here is employing people who don't know how to program at all for programming jobs? I don't get that sense at all.

I think we are far beyond the original scope of the article. When the discussion is about hiring people based on their potential because of how they would have been able to develop if privilege was normalized, then yes, I think that and equivalents is what it boils down to, because I don't think privilege does all that much after a person has identified their career and interests. I think it primarily affects the finding of that career and interest, through exposure and training.

At the point where someone suggests hiring people with fine arts degrees to write physics simulation code, because diversity, I agree the plot has been completely lost.

A bit more extreme than what I meant to imply. I guess it really comes down to what hiring based on potential really means.

And, because I haven't said this for a while, I'm kindof trying to play the economic argument here, because that is your focus. I'm not conceding my feeling that economic arguments can't be trumped by moral ones.

I've been trying to field the idea that the economic argument is the moral one. Or at least it may be, and I think it can't be immediately discounted as not being the moral one.

Good conversation, overall, thanks.

To you as well. I found it really productive, it gave me a lot to think about.
The new out of box and simple way to apply leave
Synchronizing all your files sounds like space-waste. It would be trivial to determine if dropbox does that, simply by monitoring the number of bytes sent to dropbox (Create a new file of size x, determine if the stream to dropbox transmits at least x amount of bytes) or by replacing the SSL certificate in the program with your own and then set up a fake server (This would be harder) to determine exactly what is being transmitted.

If this is indeed something nefarious, I would much rather assume it would transmit file hashes rather than the files itself. Although I can't possibly imagine this is actually true, the implications would be devastating for dropbox and it should be easy to verify by an independent third party.
You say solid, but I don't see any proof that the client actually send the file. Without something like a strace analysis, you can't really know for sure if the file was even read completely and sent to the Dropbox servers
This article does not prove "steals everything" claim. Very shallow work for "Information Security Specialist".

The reason Dropbox accesses files all over the drive may be that FS events driver generates events for every file accessed by every program, and Dropbox has to read their metadata for some reason (e.g. to check if their full path is under one of synced folders). He should elaborate by checking if Dropbox is actually scanning and reading all drives, which is hardly unnoticeable, or is it something else.

Having network activity at the same time does not mean this file has been transferred. It is incredibly hard for me to believe that Dropbox has sneakily transferred >1TB from my various computers without me and my ISP noticing. The author should monitor Dropbox traffic volumes over a week and check if it actually exceeds synced folders size before spreading panic.
A Startup that wants to Revolutionize Philanthropy
Even if it's just fstat and thus metadata it's a pretty remarkable turn of events. This would mean Dropbox would have access to a list of all the files on my computer, when I've last accessed them or when I've last written to them for example. I don't think this is something dropbox should do.

I agree that it's important to find out if they are phoning this information back home, because if they don't this is still very bad but a lot less harmfull.
I'd assume that their promise (https://puri.sm/posts/pioneering-cpu-efforts-to-liberate-lap...) to "ship with an Intel CPU fused to run unsigned BIOS code" means precisely that they leave Boot Guard disabled.

Which is much less than they market it, but that's part of the issue some people in the coreboot community have with Purism. They present it as some groundbreaking success (while it's nothing but clicking a different checkbox in a tool), and I really doubt it's the "first [laptop] to ship" that way. Chromebooks come to mind.
What if they upload file hashes? What if they upload name+type+size to fingerprint files? They don't need to upload file contents for fingerprinting your drive content.
That is because that is the ACTUAL purpose of that (Selective Sync) dialogue he is showing, contrary to his implication that it is related to upload configuration. When you have 2 work computers and one personal laptop, perhaps you have a CAD Drawings folder that you would like to sync between your work computers but don't want 100 GB of work stuff on your personal laptop. What the Selective Sync feature allows you to do is untick "CAD Drawings" on your laptop Dropbox settings, so that you don't fill up your disk with stuff you don't want in that machine's context. It's a nice feature.
byoung2 makes an important point about the product and therefore the market.

My additional question is how long you can sustain your growth - ie, will you keep growing at 29% or just keep adding 20 new people per week. One is good traction, the other incremental.
Australian Economy on the Decline?
Independently of whether DB reads/uploads all the files or not, I've arrived at a difficult position about Dropbox: I'm looking for alternatives. No, it's unrelated with politics or pricing; it's just that in many cases Dropbox sucks.

Why? Well, I mostly don't care about all the new features (mobile, Carousel, etc.). What I care the most is that i) it syncs files and ii) acts as a quasi-backup. However, I see the same old bugs from years ago and nothing gets done. To name just a few:

- If I copy a file to the Dropbox folder in Windows, it will convert it to small caps, even if the file is in Camel Case. Yes, I get that for windows caps are just "optional", but do not change it just for the sake of it!

- Many people sometimes have temporary files. Photoshop, Matlab, Word, Latex, etc. leave crumbles of temp files and folders. Can't I just set a quick rule to avoid "tmp" folders and e.g. ".tmp" files?

- A few months ago their forums went down and stayed down for around a month? Why? Technical problems. But the real reason is that they don't really care.

There is no way DB can justify their valuation with just the syncing part, and I'm fine with that. But just stopping altogether to improve in that area is a huge turn-off, and on top of that they do not care to fix bugs (there were hundreds of bug requests about the lowercase bug in the forums, before they deleted it).

Now that my rant is over, I ask you: are there any useful alternatives? I've heard that GDrive is very slow and the MSFT alternative seems a bit risky to me (will it work on Linux in the future? will it be customizable?).
Or maybe not. Your speculation is as good as mine. Or the op. Or everyone else. The point was Dropbox is accessing files outside the folder, something I would not want or expect.

"It is incredibly hard for me to believe that Dropbox has sneakily transferred >1TB"

Did they transfer hashes? name+type+size for fingerprinting? Searching for credit numbers or SSNs? Who knows. I don't. And don't do evil is no longer the basic assumption.
Does it work if I first compile for GOARM=5 and then for GOARM=7 (or vice versa)?
Maybe if you grade on a curve. But HN can and should be better.

We're working on a set of moderation tools for the community that we hope will help with this.
I dtruss-ed the dbfseventsd instances, while creating a file in my home directory, and I do see stuff like:

833/0x1c7d: read_nocancel(0x6, "/Users/daniel/foobarbaz\0", 0x17)	= 23 0
833/0x1c7d: access("/Users/daniel/foobarbaz\0", 0x4, 0x17)	= 0 0

Same thing for temporary directories (/private/var/folders), Chrome caches, etc. So, at the very least they seem to monitor the whole filesystem for events.

Maybe that's even necessary, though:

https://developer.apple.com/library/mac/documentation/Darwin...

seems to suggest it's not.
Obama criticizes Chinese tech backdoors
belak (author of dead sibling post to this one), FYI, you appear to be hellbanned.
Repex – Regex Management Simplified
I really, really doubt that the client actually sends the file. But, imagine if they read only metadata and uploaded that.

I agree with what another commented brought up - it's probably just unfortunately overaggressive 'filesystem-watch' code - IE when you change a file it checks to see if it needs to be synced and re-uploaded. It shouldn't be able to affect other files, though. Makes me wish we had more nuanced security controls, like per-app permissions a la Android/IOS.
Fully agreed about Rust; getting rid of fundamental issues rather than perpetuating the cat-and-mouse problem of chasing classes of vulnerabilities, which sometimes are even intentional backdoors is fantastic. I hope we see more languages like Rust.

But every time I hear about it, people are disappointed by the language. So how is that going?
They are probably doing statistics about our files not syncing the entire drive.

Which is not cool either
Your 54 year period since 1971 would account for Japan's lost decade of productivity.

Though I suspect an arithmetic error.
That option primarily exists to provide big Corps with a way to buy new machines and image Windows 7 on them. Once all that legacy is gone, non-Secure Boot isn't necessary anymore from a Wintel point of view.

And there won't be much opposition from Linux, given that all major (and most minor) distros now ship Secure Boot enabled.
Finding a meaningful wearable experience
Hmm there is a business model right there!

Fingerprint popular torrent movie/tv/games etc files and then monitor (via dropbox) their spread and how many computers around the world they end up on, I bet movie studios would love to measure exactly how much piracy affects them

shiiiittt
He reported your submission as a spam or the like.
> I’m not a fan of Best Practices, so I don’t like a lot of books like Design Patterns.

Interesting. I wonder how many senior programmers have the same perspective.
And we know automatic DCMA bots work on size and name alone.
My personal theory is it's something to do with Dropbox's Explorer shell extension.

(But I really don't know enough to day for sure. Still, if the shell extension mechanism is such that you get a file or list of files, it'd need to figure out whether they're in a Dropbox folder or not and play with the icons.)
Yes it does if you are playing a game that demands your grey cells to think creatively and make it to find solution. If you are playing candy crush or temple run then in no way you are going to increase the count of grey cells in your brain.
http://en.wikipedia.org/wiki/Continuous_positive_airway_pres...
There are companies that will replace your iPhone casing with a gold casing. I bet the mark-up is huge and that the market is much bigger for watches than for phones.
GPL Unison?

Add in encfs with a cheap storage VPS for off-site redundancy. It should run on android too if you have a normal-looking chroot installed.
Blog – How to Create Blog in Blogger
There is a multicore runtime in the works, with an ETA of "when it's done". That said, you have a couple of full-featured monadic concurrency libraries (Lwt and Async).

It also has functors (they let you parametrize a module over other modules), which F# doesn't, and you can do AST rewriting at compile-time via PPX (don't know if F# has anything like that). On the other hand, F# has access to the .NET ecosystem (which is admittedly larger than the OCaml one, though it suffers from enterprisitis), and has some nice goodies like type providers.
I agree with you. The main problem is that why dropbox accesses the files that it is not permitted.
This started with Haswell. Hardly anyone seems to care :(
Filed – a simple and fast HTTP server for serving local static files
BootGuard won't prevent Linux from running. But in Verified Boot mode it prevents coreboot, and with it any work to customize the even lower layers of the system.
Dropbox does not allow SSL interception of its traffic. It immediately errors out saying host is not trusted or smth else.
Because then every application would be an island and useless.

Red Hat Linux tried a variation of this with the SELinux policy that preceded the 'targeted' policy (I forgot its name). Processes that did not have a policy adding permissions would be allowed to virtually read/write nothing.

The net result was that nearly everyone switched off SELinux.

Afterwards, Red Hat worked in the opposite direction. In the so-called 'targeted' policy processes are allowed to do what a normal UNIX process is allowed to do, unless there is a policy defined for them. Since they provide policies for commonly used daemons it adds security, while not making life too hard for sysadmins. Net result: most people keep SELinux enabled and have safer systems.
I'm not a Dropbox user, but why doesn't anyone with Dropbox just install a local proxy and try to read out the requests made to the Dropbox servers. The speculations on spying, etc. in this thread are completely worthles, just look at what they're sending to the servers.
SEEKING WORK: Remote

I am a certified Java, Liferay developer. I have around 7+ years of experience in building full stack web applications.

Technologies: Java, Liferay, Javascript, SAML2, JSF, Struts, Spring, RESTful, Hibernate.

Linkedin: http://in.linkedin.com/pub/kumaravadivel-t-s/25/537/711

Email: kumaravadivelts.mca@gmail.com
We need to be cautious about AI, but that doesn't mean we should fear it
Most likely won't help you, but I just keep using external drives and DVDs for backups.

No way I am sharing private documents over the "cloud".
Besides what everyone already mentioned. I think Symbian also did it,
do you mean chroot. Unix had that in 1979.