News for hackers. Stuff that matters.
Re:Dropbox is using an unsigned binary to install kernel ext... by deong on Monday February 27, 2017 @10:17AM (#13744817)
Well, as far as I'm aware, there have been no actual implications. I think it's a perfectly reasonable summary to say that Dropbox does a bunch of weird shit to enable features customers want that can't realistically be delivered any other way, and so far there have been no drawbacks to the approach in practice.

I get the argument from the other side as well, but if you're Dropbox, you just want to make the best file-syncing application you can make, and any other choice they could have made in these situations would be worse in lots of ways. We can quibble over which set of compromises is the right set, but I doubt you'll find a single set of uniformly preferred options. To be sure, there are probably some low cost wins they could make -- making the signing status of everything more obvious, etc., but I'm not sure what your desired outcome here really is.

I guess I mostly just find it annoying that people seem to think anything other than presenting my 67 year old mother with a dialog of full disclosure about kernel extensions is somehow the nefarious work of a shady company rather than a conscious design arrived at through a reasonable comparison of the options.

Re:Dropbox is using an unsigned binary to install kernel ext... by cat199 on Monday February 27, 2017 @10:42AM (#13744987)
Because there is no middle ground here, like, say, a sensibly labeled checkbox in the preferences, which defaults to on?

As for implications: We're here talking about it. That is an implication. This is not the first time either.

As for uniformly preferred: not futzing around with system level stuff without a preference or notification tends to be pretty much universal.

Re:Dropbox is using an unsigned binary to install kernel ext... by geofft on Monday February 27, 2017 @10:52AM (#13745074)
What is a "sensibly labeled checkbox"?

    [x] Enable Smart Sync
    [x] Install Dropbox drivers required for Smart Sync
What happens if I uncheck the second checkbox but not the first? Does Smart Sync just sit there and look sad?

Maybe just a note under the Smart Sync thing saying "Smart Sync drivers are installed. Disable Smart Sync to remove"? Will that actually make anyone happier?

Also—Dropbox is a filesystem. (Logically, the entire product is a filesystem; pedantically, traditional Dropbox might not be but Smart Sync definitely fits the definition of a network filesystem.) Traditionally on UNIX, if you're installing a third-party filesystem like AFS or Lustre or ZFS or whatever else, you're installing drivers. The fact that installing a filesystem installs both userspace software and drivers doesn't feel weird to me at all.

Re:Dropbox is using an unsigned binary to install kernel ext... by saghm on Monday February 27, 2017 @04:02PM (#13748015)
> What happens if I uncheck the second checkbox but not the first? Does Smart Sync just sit there and look sad?

Is this a serious question? I've seen dozens if not hundreds of UI's that gray out a checkbox (either with or without the box checked) once you click a different one. Obviously this might not be an optimal solution for this specific dialog, but you could easily do something like:

[x] Enable Smart Sync (NOTE: This requires installing a driver onto your computer)

Re:Dropbox is using an unsigned binary to install kernel ext... by newhouseb on Monday February 27, 2017 @08:15PM (#13750289)
This is actually what the opt-in looks like for Smart Sync (except at an admin level since team admins opt their users into it). There's also an individual opt-out if your team admin has opted you in and you don't want things enabled.
Re:Dropbox is using an unsigned binary to install kernel ext... by tedunangst on Monday February 27, 2017 @11:59AM (#13745645)
Traditional UNIX filesystems didn't backdoor the accessibility panel for persistence.
Re:Dropbox is using an unsigned binary to install kernel ext... by deong on Monday February 27, 2017 @12:11PM (#13745766)
Well, where the analogy falls down a bit is that traditional UNIX filesystems have traditionally been installed and maintained by UNIX systems administrators.

My point wasn't to blindly defend everything Dropbox has done. I'm sure they've made mistakes, both in design and implementation. My point was that things like their hack of the accessibility panel are, in my opinion, overblown by the average technical reader.

I think bothering the user with an accessibility panel is tedious "Charlie work" that I'd prefer be avoided. I understand why it works the way it does, and I understand the theoretical risk the OS is trying to mitigate. But I'm already trusting Dropbox with my data. It's silly for the OS to treat them like some unknown piece of malware, it's just that the OS isn't a generally intelligent agent able to make accurate determinations of that sort.

I get all that. It doesn't change the fact that I as the user of my computer just want Dropbox to do whatever it needs to do to work. I'm capable of doing the accessibility dance that most applications require, but not everyone is, and I think it's a reasonable position for Dropbox to take that if users are signing up and downloading our app, then implicitly they trust us to check the accessibility box. Is that an objectively acceptable argument? No, but all I'm arguing is that it's reasonable. It doesn't imply maliciousness that that's the argument that won the day inside Dropbox.

Re:Dropbox is using an unsigned binary to install kernel ext... by tedunangst on Monday February 27, 2017 @12:21PM (#13745864)
I think at least some people object more to the less than forthright disclosure of what they're doing than the technical tricks. If they had a blog post "behind the scenes at dropbox kext headquarters" that'd be fine. It's the coverup, not the crime.
Re:Dropbox is using an unsigned binary to install kernel ext... by maccam94 on Monday February 27, 2017 @12:57PM (#13746224)
Re:Dropbox is using an unsigned binary to install kernel ext... by tedunangst on Monday February 27, 2017 @01:34PM (#13746562)
Yeah, something like that would be pretty good. :)
Re:Dropbox is using an unsigned binary to install kernel ext... by geofft on Monday February 27, 2017 @03:13PM (#13747507)
I'm not sure that's true, actually. The ways that AFS hooks into the kernel, especially on kernels that don't have actual loadable module support (older commercial UNIXes) or on kernels that try to limit syscall hooking (e.g., Linux), are distressingly close to the ways that a rootkit hooks into the kernel.